@open-mercato/core 0.10.1-develop.7741.1.61a2652671 → 0.10.1-develop.7749.1.ea3edf75e3

package/src/modules/auth/i18n/pl.json

@@ -107,6 +107,8 @@
   "auth.acl.features.channel_resend.view": "Wyświetl konfigurację kanału Resend",
   "auth.acl.features.channel_ses.configure": "Konfiguruj domyślne ustawienia kanału Amazon SES",
   "auth.acl.features.channel_ses.view": "Wyświetl konfigurację kanału Amazon SES",
+  "auth.acl.features.channel_smtp.configure": "Konfiguruj domyślne ustawienia kanału SMTP",
+  "auth.acl.features.channel_smtp.view": "Wyświetl konfigurację kanału SMTP",
   "auth.acl.features.checkout.create": "Twórz linki i szablony płatności",
   "auth.acl.features.checkout.delete": "Usuwaj linki i szablony płatności",
   "auth.acl.features.checkout.edit": "Edytuj linki i szablony płatności",
@@ -442,6 +444,7 @@
   "auth.acl.modules.channel_imap": "Kanał e-mail IMAP + SMTP",
   "auth.acl.modules.channel_resend": "Kanał e-mail Resend",
   "auth.acl.modules.channel_ses": "Kanał e-mail Amazon SES",
+  "auth.acl.modules.channel_smtp": "Kanał e-mail SMTP",
   "auth.acl.modules.checkout": "Kasa",
   "auth.acl.modules.communication_channels": "Kanały komunikacji",
   "auth.acl.modules.configs": "Konfiguracja",

package/src/modules/notifications/api/[id]/action/route.ts

@@ -97,6 +97,14 @@ export const openApi = {
           },
         },
       },
+      403: {
+        description: 'The stored action command is not declared by the notification type with the same action id and command, or the user lacks the features the declared action requires (`code: notification_action_forbidden`)',
+        content: {
+          'application/json': {
+            schema: actionConflictResponseSchema,
+          },
+        },
+      },
       400: {
         description: 'Action not found or failed',
         content: {

package/src/modules/notifications/api/route.ts

@@ -9,6 +9,7 @@ import {
   resolveCrudCache,
 } from '@open-mercato/shared/lib/crud/cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE } from '@open-mercato/shared/modules/notifications/types'
 import { Notification } from '../data/entities'
 import { listNotificationsSchema, createNotificationSchema } from '../data/validators'
 import { toNotificationDto } from '../lib/notificationMapper'
@@ -21,12 +22,14 @@ import {
   NOTIFICATION_RESOURCE_KIND,
   notificationCrudErrorResponse,
   notificationValidationErrorResponse,
+  rejectNotificationActionCommands,
   resolveGuardedNotificationContext,
   resolveNotificationContext,
   runGuardedNotificationWrite,
   TENANT_SCOPE_REQUIRED_ERROR_CODE,
 } from '../lib/routeHelpers'
 import {
+  actionConflictResponseSchema,
   buildNotificationsCrudOpenApi,
   createPagedListResponseSchema,
   notificationItemSchema,
@@ -216,6 +219,8 @@ export async function POST(req: Request) {
   if (!parsed.success) {
     return notificationValidationErrorResponse(parsed.error)
   }
+  const commandRejection = await rejectNotificationActionCommands(parsed.data)
+  if (commandRejection) return commandRejection
 
   try {
     const guarded = await runGuardedNotificationWrite(
@@ -251,6 +256,7 @@ const notificationsCrudOpenApi = buildNotificationsCrudOpenApi({
 })
 
 const notificationsCrudGet = notificationsCrudOpenApi.methods?.GET ?? {}
+const notificationsCrudPost = notificationsCrudOpenApi.methods?.POST ?? {}
 
 // The CRUD factory documents errors only for DELETE, and POST already gets an auto-generated 403
 // from its `requireFeatures` metadata. GET is authenticated-only, so its tenant-scope rejection has
@@ -270,5 +276,16 @@ export const openApi: OpenApiRouteDoc = {
         },
       ],
     },
+    POST: {
+      ...notificationsCrudPost,
+      errors: [
+        ...(notificationsCrudPost.errors ?? []),
+        {
+          status: 400,
+          description: `Invalid payload, or an action carries a \`commandId\` (code: ${NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE})`,
+          schema: actionConflictResponseSchema,
+        },
+      ],
+    },
   },
 }

package/src/modules/notifications/data/validators.ts

@@ -15,7 +15,7 @@ export const notificationActionSchema = z.object({
   labelKey: z.string().optional(),
   variant: z.enum(['default', 'secondary', 'destructive', 'outline', 'ghost']).optional(),
   icon: z.string().optional(),
-  commandId: z.string().optional(),
+  commandId: z.string().optional().describe('Refused by the HTTP create routes (400 notification_action_command_not_allowed); command actions are attached by server code from the notification type definition'),
   href: safeRelativeHrefSchema.optional(),
   confirmRequired: z.boolean().optional(),
   confirmMessage: z.string().optional(),

package/src/modules/notifications/i18n/de.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Ungültige Zustelleinstellungen",
   "notifications.empty": "Keine Benachrichtigungen",
   "notifications.error.action": "Aktion konnte nicht ausgeführt werden",
+  "notifications.error.actionCommandNotAllowed": "Über die API erstellte Benachrichtigungsaktionen dürfen keine Befehle ausführen",
+  "notifications.error.actionForbidden": "Sie dürfen diese Benachrichtigungsaktion nicht ausführen",
   "notifications.error.load": "Benachrichtigungen konnten nicht geladen werden",
   "notifications.filters.actionRequired": "Aktion erforderlich",
   "notifications.filters.all": "Alle",

package/src/modules/notifications/i18n/en.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Invalid delivery settings",
   "notifications.empty": "No notifications",
   "notifications.error.action": "Failed to execute action",
+  "notifications.error.actionCommandNotAllowed": "Notification actions created through the API cannot run commands",
+  "notifications.error.actionForbidden": "You are not allowed to run this notification action",
   "notifications.error.load": "Failed to load notifications",
   "notifications.filters.actionRequired": "Action Required",
   "notifications.filters.all": "All",

package/src/modules/notifications/i18n/es.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Configuración de entrega no válida",
   "notifications.empty": "Sin notificaciones",
   "notifications.error.action": "No se pudo ejecutar la acción",
+  "notifications.error.actionCommandNotAllowed": "Las acciones de notificación creadas mediante la API no pueden ejecutar comandos",
+  "notifications.error.actionForbidden": "No tienes permiso para ejecutar esta acción de notificación",
   "notifications.error.load": "No se pudieron cargar las notificaciones",
   "notifications.filters.actionRequired": "Acción requerida",
   "notifications.filters.all": "Todas",

package/src/modules/notifications/i18n/ko.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "잘못된 전달 설정입니다",
   "notifications.empty": "알림 없음",
   "notifications.error.action": "작업을 실행하지 못했습니다",
+  "notifications.error.actionCommandNotAllowed": "API로 생성한 알림 작업은 명령을 실행할 수 없습니다",
+  "notifications.error.actionForbidden": "이 알림 작업을 실행할 권한이 없습니다",
   "notifications.error.load": "알림을 불러오지 못했습니다",
   "notifications.filters.actionRequired": "조치 필요",
   "notifications.filters.all": "전체",

package/src/modules/notifications/i18n/pl.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Nieprawidłowe ustawienia dostarczania",
   "notifications.empty": "Brak powiadomień",
   "notifications.error.action": "Nie udało się wykonać akcji",
+  "notifications.error.actionCommandNotAllowed": "Akcje powiadomień utworzone przez API nie mogą uruchamiać poleceń",
+  "notifications.error.actionForbidden": "Nie masz uprawnień do wykonania tej akcji powiadomienia",
   "notifications.error.load": "Nie udało się załadować powiadomień",
   "notifications.filters.actionRequired": "Wymagana akcja",
   "notifications.filters.all": "Wszystkie",

package/src/modules/notifications/lib/notificationService.ts

@@ -6,8 +6,13 @@ import { Notification, type NotificationStatus } from '../data/entities'
 import type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'
 import {
   NOTIFICATION_ACTION_ALREADY_EXECUTED_ERROR_CODE,
+  NOTIFICATION_ACTION_FORBIDDEN_ERROR_CODE,
+  type NotificationAction,
   type NotificationPollData,
+  type NotificationTypeAction,
 } from '@open-mercato/shared/modules/notifications/types'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from './events'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
@@ -97,6 +102,27 @@ function actionAlreadyExecuted(): CrudHttpError {
   })
 }
 
+async function actionForbidden(): Promise<CrudHttpError> {
+  const { translate } = await resolveTranslations()
+  return new CrudHttpError(403, {
+    error: translate('notifications.error.actionForbidden', 'You are not allowed to run this notification action'),
+    code: NOTIFICATION_ACTION_FORBIDDEN_ERROR_CODE,
+  })
+}
+
+/**
+ * The command action the notification's registered type declares for a stored action: same action
+ * id (across `actions` and `optionalActions`) and same `commandId`. Anything else is not dispatched.
+ */
+function findDeclaredCommandAction(type: string, action: NotificationAction): NotificationTypeAction | null {
+  const definition = getNotificationType(type)
+  if (!definition) return null
+  const declared = [...definition.actions, ...(definition.optionalActions ?? [])]
+    .find((candidate) => candidate.id === action.id)
+  if (!declared?.commandId || declared.commandId !== action.commandId) return null
+  return declared
+}
+
 function applyNotificationContent(
   notification: Notification,
   input: NotificationContentInput,
@@ -285,6 +311,39 @@ export interface NotificationServiceDeps {
 export function createNotificationService(deps: NotificationServiceDeps): NotificationService {
   const { em: rootEm, eventBus, commandBus, container } = deps
 
+  /**
+   * Whether the clicking user holds every feature a declared notification action requires.
+   * Fails closed: no user, no container, or a failing RBAC check denies the action.
+   */
+  const userHoldsActionFeatures = async (
+    requiredFeatures: string[] | undefined,
+    scopeCtx: NotificationServiceContext,
+  ): Promise<boolean> => {
+    if (!requiredFeatures || requiredFeatures.length === 0) return true
+    if (!scopeCtx.userId || !container) return false
+    try {
+      const rbacService = container.resolve('rbacService') as {
+        userHasAllFeatures: (
+          userId: string,
+          features: string[],
+          scope: { tenantId: string | null; organizationId: string | null },
+        ) => Promise<boolean>
+      }
+      const allowed = await rbacService.userHasAllFeatures(
+        scopeCtx.userId,
+        requiredFeatures,
+        { tenantId: scopeCtx.tenantId, organizationId: scopeCtx.organizationId ?? null },
+      )
+      return allowed === true
+    } catch (err) {
+      getTelemetryRuntime()?.reportError(err, {
+        module: 'notifications',
+        code: 'notifications.action_feature_check_failed',
+      })
+      return false
+    }
+  }
+
   /**
    * Resolves the authoritative delivery-channel set for one recipient at create time — the single
    * gate that folds per-send target, per-type eligibility, registered strategies, and the
@@ -696,6 +755,13 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         throw actionAlreadyExecuted()
       }
 
+      if (action.commandId) {
+        const declared = findDeclaredCommandAction(notification.type, action)
+        if (!declared || !(await userHoldsActionFeatures(declared.requiredFeatures, ctx))) {
+          throw await actionForbidden()
+        }
+      }
+
       const actionedAt = new Date()
       const previousStatus = notification.status
       const previousActionedAt = notification.actionedAt ?? null
@@ -749,8 +815,8 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
       if (action.commandId && commandBus && container) {
         const commandInput = {
-          id: notification.sourceEntityId,
           ...input.payload,
+          id: notification.sourceEntityId,
         }
 
         // Build a CommandRuntimeContext from the notification service context

package/src/modules/notifications/lib/routeHelpers.ts

@@ -5,7 +5,9 @@ import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/d
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE } from '@open-mercato/shared/modules/notifications/types'
 import { resolveNotificationService, type NotificationService } from './notificationService'
+import { actionConflictResponseSchema } from '../api/openapi'
 
 /**
  * Mutation-guard resource kind for notification rows.
@@ -60,6 +62,32 @@ export async function notificationValidationErrorResponse(error: z.ZodError): Pr
   )
 }
 
+export type NotificationActionsPayload = { actions?: Array<{ commandId?: string | null }> | null }
+
+/**
+ * Reject an API-supplied action that carries a `commandId`.
+ *
+ * Command-backed actions run with the clicking user's identity, so only server code may attach
+ * them, from the notification type definition. Called after payload validation and before the
+ * mutation guard or the service write.
+ */
+export async function rejectNotificationActionCommands(
+  data: NotificationActionsPayload,
+): Promise<Response | null> {
+  if (!data.actions?.some((action) => action.commandId)) return null
+  const { t } = await resolveTranslations()
+  return Response.json(
+    {
+      error: t(
+        'notifications.error.actionCommandNotAllowed',
+        'Notification actions created through the API cannot run commands',
+      ),
+      code: NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE,
+    },
+    { status: 400 },
+  )
+}
+
 export function notificationCrudErrorResponse(error: unknown): Response | null {
   if (!isCrudHttpError(error)) return null
   return Response.json(error.body ?? { error: 'Notification request failed' }, { status: error.status })
@@ -235,6 +263,8 @@ export function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(
     if (!parsed.success) {
       return notificationValidationErrorResponse(parsed.error)
     }
+    const commandRejection = await rejectNotificationActionCommands(parsed.data as NotificationActionsPayload)
+    if (commandRejection) return commandRejection
 
     try {
       const guarded = await runGuardedNotificationWrite(
@@ -298,6 +328,14 @@ export function createBulkNotificationOpenApi<TSchema extends z.ZodTypeAny>(
             },
           },
         },
+        400: {
+          description: `Invalid payload, or an action carries a \`commandId\` (code: ${NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE})`,
+          content: {
+            'application/json': {
+              schema: actionConflictResponseSchema,
+            },
+          },
+        },
       },
     },
   }

package/src/modules/payment_gateways/lib/gateway-service.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto'
-import { QueryOrder } from '@mikro-orm/core'
+import { LockMode, QueryOrder } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -21,7 +21,7 @@ import type { IntegrationStateService } from '../../integrations/lib/state-servi
 import type { IntegrationLogService } from '../../integrations/lib/log-service'
 import { conflict, CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { GatewayPaymentOperation, GatewaySessionInitialization, GatewayTransaction } from '../data/entities'
-import { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'
+import { canApplyManualAction, isValidTransition, resolveImpliedCaptureStatus, type ManualGatewayAction } from './status-machine'
 import { emitPaymentGatewayEvent } from '../events'
 import { readGatewayMetadata, readWebhookLog } from './transaction-fields'
 import { reconcileSessionAmountWithOrder } from './order-amount-reconciliation'
@@ -124,6 +124,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
     transactionId: string,
     scope: { organizationId: string; tenantId: string },
     targetEm: EntityManager = em,
+    options?: { lockMode: LockMode.PESSIMISTIC_WRITE },
   ): Promise<GatewayTransaction> {
     const transaction = await findOneWithDecryption(
       targetEm,
@@ -134,7 +135,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         tenantId: scope.tenantId,
         deletedAt: null,
       },
-      undefined,
+      options,
       scope,
     )
     if (!transaction) {
@@ -765,42 +766,57 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         receivedAt?: string
       }
     }, scope: { organizationId: string; tenantId: string }): Promise<void> {
-      const transaction = await findTransactionOrThrow(transactionId, scope)
-      const currentStatus = transaction.unifiedStatus as UnifiedPaymentStatus
-      const canTransition = isValidTransition(currentStatus, update.unifiedStatus)
-      const shouldApplyStatus = canTransition && update.unifiedStatus !== currentStatus
-      const previousStatus = transaction.unifiedStatus
-      if (shouldApplyStatus) {
-        transaction.unifiedStatus = update.unifiedStatus
-        alignCapturedAmountWithStatus(transaction, update.unifiedStatus)
-      }
-      if (update.providerStatus) {
-        transaction.gatewayStatus = update.providerStatus
-      }
-      if (update.providerData) {
-        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), ...update.providerData }
-      }
-      if (update.webhookEvent) {
-        const webhookLog = readWebhookLog(transaction.webhookLog)
-        webhookLog.push({
-          eventType: update.webhookEvent.eventType,
-          receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),
-          idempotencyKey: update.webhookEvent.idempotencyKey,
-          unifiedStatus: update.unifiedStatus,
-          processed: update.webhookEvent.processed,
-        })
-        transaction.webhookLog = webhookLog
-      }
-      transaction.lastWebhookAt = new Date()
-      await em.flush()
+      const { transaction, previousStatus, impliedCaptureStatus, shouldApplyStatus } = await em.fork().transactional(async (tx) => {
+        const locked = await findTransactionOrThrow(transactionId, scope, tx, { lockMode: LockMode.PESSIMISTIC_WRITE })
+        const currentStatus = locked.unifiedStatus as UnifiedPaymentStatus
+        const implied = resolveImpliedCaptureStatus(currentStatus, update.unifiedStatus)
+        const canTransition = isValidTransition(currentStatus, update.unifiedStatus) || implied !== null
+        const applies = canTransition && update.unifiedStatus !== currentStatus
+        if (applies) {
+          if (implied) alignCapturedAmountWithStatus(locked, implied)
+          locked.unifiedStatus = update.unifiedStatus
+          alignCapturedAmountWithStatus(locked, update.unifiedStatus)
+        }
+        if (update.providerStatus) {
+          locked.gatewayStatus = update.providerStatus
+        }
+        if (update.providerData) {
+          locked.gatewayMetadata = { ...readGatewayMetadata(locked.gatewayMetadata), ...update.providerData }
+        }
+        if (update.webhookEvent) {
+          const webhookLog = readWebhookLog(locked.webhookLog)
+          webhookLog.push({
+            eventType: update.webhookEvent.eventType,
+            receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),
+            idempotencyKey: update.webhookEvent.idempotencyKey,
+            unifiedStatus: update.unifiedStatus,
+            processed: update.webhookEvent.processed,
+          })
+          locked.webhookLog = webhookLog
+        }
+        locked.lastWebhookAt = new Date()
+        await tx.flush()
+        return {
+          transaction: locked,
+          previousStatus: currentStatus,
+          impliedCaptureStatus: applies ? implied : null,
+          shouldApplyStatus: applies,
+        }
+      })
       if (shouldApplyStatus) {
-        await emitStatusEvent(update.unifiedStatus, {
+        const eventPayload = {
           transactionId: transaction.id,
           paymentId: transaction.paymentId,
           providerKey: transaction.providerKey,
-          previousStatus,
           organizationId: transaction.organizationId,
           tenantId: transaction.tenantId,
+        }
+        if (impliedCaptureStatus) {
+          await emitStatusEvent(impliedCaptureStatus, { ...eventPayload, previousStatus })
+        }
+        await emitStatusEvent(update.unifiedStatus, {
+          ...eventPayload,
+          previousStatus: impliedCaptureStatus ?? previousStatus,
         })
       }
       await writeTransactionLog(
@@ -811,6 +827,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         shouldApplyStatus ? 'Payment status synchronized from webhook' : 'Webhook received with no status transition',
         {
           previousStatus,
+          ...(impliedCaptureStatus ? { impliedStatus: impliedCaptureStatus } : {}),
           nextStatus: update.unifiedStatus,
           providerStatus: update.providerStatus ?? null,
           eventType: update.webhookEvent?.eventType ?? null,

package/src/modules/payment_gateways/lib/status-machine.ts

@@ -42,3 +42,22 @@ export function canApplyManualAction(action: ManualGatewayAction, from: UnifiedP
   if (targets.includes(from)) return true
   return targets.some((target) => isValidTransition(from, target))
 }
+
+const REFUND_STATUSES: Set<UnifiedPaymentStatus> = new Set(['refunded', 'partially_refunded'])
+
+/**
+ * A provider-confirmed refund proves the payment was captured. When a refund status reaches a
+ * transaction whose capture was not recorded yet (the capture webhook is late, or was never
+ * delivered), the transaction passes through `captured` on its way to the refund status instead
+ * of dropping the refund. Returns that intermediate status, or `null` when no bridge applies.
+ */
+export function resolveImpliedCaptureStatus(
+  from: UnifiedPaymentStatus,
+  to: UnifiedPaymentStatus,
+): UnifiedPaymentStatus | null {
+  if (!REFUND_STATUSES.has(to)) return null
+  if (isValidTransition(from, to)) return null
+  if (!isValidTransition(from, 'captured')) return null
+  if (!isValidTransition('captured', to)) return null
+  return 'captured'
+}

package/src/modules/payment_gateways/lib/webhook-processor.ts

@@ -103,7 +103,7 @@ export async function processPaymentGatewayWebhookJob(
     }
 
     const providerStatus = typeof event.data.status === 'string' ? event.data.status : ''
-    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType)
+    const unifiedStatus = adapter.mapStatus(providerStatus, event.eventType, { ...event, timestamp: new Date(event.timestamp) })
     await writeTransactionLog(integrationLogService, providerKey, scope, transaction.id, 'info', 'Payment gateway webhook received', {
       eventType: event.eventType,
       providerStatus,

package/src/modules/staff/notifications.ts

@@ -17,6 +17,7 @@ export const notificationTypes: NotificationTypeDefinition[] = [
         variant: 'default',
         icon: 'check',
         commandId: 'staff.leave-requests.accept',
+        requiredFeatures: ['staff.leave_requests.manage'],
       },
       {
         id: 'reject',
@@ -24,6 +25,7 @@ export const notificationTypes: NotificationTypeDefinition[] = [
         variant: 'destructive',
         icon: 'x',
         commandId: 'staff.leave-requests.reject',
+        requiredFeatures: ['staff.leave_requests.manage'],
       },
     ],
     primaryActionId: 'approve',

package/src/modules/workflows/AGENTS.md

@@ -100,7 +100,7 @@ Definition → startWorkflow() → Instance → executeWorkflow() loop
 | `UPDATE_ENTITY` | Mutate an entity via the command bus. `CommandBus.execute` does not declare a signal; a write that has already begun cannot be cancelled on timeout. |
 | `EMIT_EVENT` | Emit a domain event to the event bus. `eventBus.emitEvent` does not declare a signal; an emit that has already begun cannot be cancelled on timeout. |
 | `EXECUTE_FUNCTION` | Run a registered custom function. Functions receive `(args, context, signal?: AbortSignal)` — the third arg is additive; existing two-arg functions are unaffected. |
-| `WAIT` | Delay execution for a configured duration |
+| `WAIT` | Delay execution for a configured duration. A sync WAIT over `MAX_INLINE_WAIT_MS` (60 s) that ENDS its transition is queued like an async one (`executeActivities` `queueLongInlineWaits`, opted into by the transition handler only — the AUTOMATED-step caller does not park on a queued result). An in-process WAIT never hands `setTimeout` more than `MAX_TIMER_DELAY_MS` (2^31−1 ms): Node would fire it after 1 ms. |
 | `SET_VARIABLE` | Write values into workflow context at dot paths (assignments land at top-level context, not namespaced under the activity) |
 
 ## Context Backbone (contextSchema · ledger · picker · samples · test step)
@@ -934,7 +934,7 @@ Treat a regression here as a broken feature, not a nit.
 | Variable | Effect | Default |
 |----------|--------|---------|
 | `OM_WORKFLOWS_ALLOW_PRIVATE_URLS` | When `1`/`true`/`yes`, bypasses the SSRF guard in `CALL_WEBHOOK` so workflow authors can hit `localhost`, RFC1918, and `.internal` targets. For dev only — MUST remain unset in production. | unset (guard enforced) |
-| `OM_WORKFLOWS_MAX_CONDITION_ATTEMPTS` | Hard cap on WAIT_FOR_CONDITION poll re-enqueues; reaching it forces `CONDITION_TIMED_OUT` so a never-satisfiable predicate cannot saturate the queue. | `1000` |
+| `OM_WORKFLOWS_MAX_CONDITION_ATTEMPTS` | Floor of the cap on WAIT_FOR_CONDITION poll re-enqueues; reaching the cap forces `CONDITION_TIMED_OUT` so a never-satisfiable predicate cannot saturate the queue. Each waiter's cap is raised to the polls its own timeout needs (`resolveConditionAttemptCap`: `timeoutMs / pollIntervalMs + 1`), so a long timeout is never cut short by the floor. | `1000` |
 | `OM_WORKFLOWS_ENV_INTERPOLATION_ALLOWLIST` | Comma-separated non-secret process env keys allowed for `{{env.*}}` interpolation in workflow activity config. `APP_URL` is always allowed. Never include secrets. | unset (`APP_URL` only) |
 
 ## DI Services

package/src/modules/workflows/data/entities.ts

@@ -675,6 +675,12 @@ export class StepInstance {
   @Property({ name: 'exited_at', type: Date, nullable: true })
   exitedAt?: Date | null
 
+  /**
+   * @deprecated Written on the COMPLETED path only and `null` for any step that
+   * lasted 2^31 ms (~24.86 days) or longer, which a Postgres `integer` cannot
+   * hold. Derive the duration from `exitedAt - enteredAt` instead; the column
+   * is scheduled for removal no earlier than 0.11.0 (see UPGRADE_NOTES.md).
+   */
   @Property({ name: 'execution_time_ms', type: 'integer', nullable: true })
   executionTimeMs?: number | null
 

package/src/modules/workflows/lib/activity-executor.ts

@@ -62,7 +62,7 @@ import './activity-registry-bootstrap'
 import { bindActivityExecutor } from './activity-types'
 import { getActivityType } from './activity-registry'
 import { logWorkflowEvent } from './event-logger'
-import { calculateWaitDelayMs, parseDuration } from './duration'
+import { MAX_INLINE_WAIT_MS, assertInProcessWaitDelay, calculateWaitDelayMs, parseDuration } from './duration'
 
 export { calculateWaitDelayMs } from './duration'
 import { resolveActivityTimeoutMs } from './activityTimeoutFields'
@@ -683,6 +683,31 @@ export async function executeActivity(
   }
 }
 
+export interface ExecuteActivitiesOptions {
+  /**
+   * Hand a synchronous activity with a long `enqueueDelayMs` (a WAIT over
+   * `MAX_INLINE_WAIT_MS`) to the activity queue instead of sleeping in-process.
+   * Only the transition's LAST activity qualifies, so nothing authored after the
+   * wait can run before it elapses. Only callers that park on an `async` result
+   * (the transition handler) may opt in — a caller that does not would let the
+   * run move on without waiting at all.
+   */
+  queueLongInlineWaits?: boolean
+}
+
+function isLongInlineWait(activity: ActivityDefinition, context: ActivityContext): boolean {
+  const entry = getActivityType(activity.activityType)
+  if (!entry?.enqueueDelayMs || entry.async.capable === false) return false
+  try {
+    const delayMs = entry.enqueueDelayMs(
+      interpolateActivityConfig(activity.config, context, activity.activityType, activity.activityName)
+    )
+    return delayMs !== null && delayMs > MAX_INLINE_WAIT_MS
+  } catch {
+    return false
+  }
+}
+
 /**
  * Execute multiple activities in sequence
  * Supports both synchronous and asynchronous (queued) execution
@@ -697,7 +722,8 @@ export async function executeActivities(
   em: EntityManager,
   container: AwilixContainer,
   activities: ActivityDefinition[],
-  context: ActivityContext
+  context: ActivityContext,
+  options: ExecuteActivitiesOptions = {}
 ): Promise<ActivityExecutionResult[]> {
   const results: ActivityExecutionResult[] = []
 
@@ -709,9 +735,15 @@ export async function executeActivities(
 
   for (let i = 0; i < activities.length; i++) {
     const activity = activities[i]
+    const isLastActivity = i === activities.length - 1
+    const queueAsLongWait =
+      !activity.async &&
+      options.queueLongInlineWaits === true &&
+      isLastActivity &&
+      isLongInlineWait(activity, context)
 
     // Check if activity should run async
-    if (activity.async && !forceSynchronous) {
+    if ((activity.async || queueAsLongWait) && !forceSynchronous) {
       // Enqueue for background execution
       const jobId = await enqueueActivity(em, activity, context)
 
@@ -1389,7 +1421,7 @@ export async function executeFunction(
  *   this handler returns immediately when called from the worker
  */
 export async function executeWait(config: any): Promise<any> {
-  const durationMs = calculateWaitDelayMs(config)
+  const durationMs = assertInProcessWaitDelay(calculateWaitDelayMs(config))
 
   // In sync mode, actually sleep for the duration
   // In async mode (called from worker), the delay already happened via queue scheduling

package/src/modules/workflows/lib/activity-types.ts

@@ -23,7 +23,7 @@
 import { z, type ZodTypeAny } from 'zod'
 import { commandRegistry } from '@open-mercato/shared/lib/commands/registry'
 import { getActivityType, registerActivityType } from './activity-registry'
-import { calculateWaitDelayMs } from './duration'
+import { assertInProcessWaitDelay, calculateWaitDelayMs } from './duration'
 import {
   callApiConfigSchema,
   callWebhookConfigSchema,
@@ -342,7 +342,7 @@ export function registerBuiltinActivityTypes(): void {
       { id: 'until', component: 'datetime' },
     ],
     execute: (config) => {
-      const durationMs = calculateWaitDelayMs(config)
+      const durationMs = assertInProcessWaitDelay(calculateWaitDelayMs(config))
       return new Promise((resolve) => {
         setTimeout(() => resolve({ waited: true, durationMs }), durationMs)
       })