@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/workflows/lib/workflow-executor.js

@@ -1,11 +1,35 @@
 import { LockMode } from "@mikro-orm/core";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import {
   WorkflowInstance,
   WorkflowEvent
 } from "../data/entities.js";
 import { compensateWorkflow } from "./compensation-handler.js";
+import { WORKFLOW_ENGINE_VERSION, isEngineVersionSupported } from "./engine-version.js";
+import {
+  WORKFLOW_ERROR_CONTEXT_KEY,
+  buildErrorContextEntry
+} from "./error-routing.js";
+import { excludeNonNormalTransitions } from "./route-kinds.js";
+import {
+  WORKFLOW_AGENT_OUTCOME_CONTEXT_KEY,
+  readAgentOutcomeMarker,
+  resolveAgentOutcomeHandling
+} from "./outcome-routing.js";
+import { scheduleWorkflowErrorHandler } from "./error-handler.js";
+import { resolveRunOutcome } from "./run-outcome.js";
+import { collectRunOutcomeEvidence } from "./run-outcome-evidence.js";
 import { findWorkflowDefinition, findDefinitionForInstance } from "./find-definition.js";
+import { resolveWorkflowDefinitionExecutionUserId } from "./definition-grant.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { emitWorkflowsEvent } from "../events.js";
+import { DRY_RUN_EVENT_TYPES } from "./dry-run.js";
+import {
+  STEP_THROUGH_EVENT_TYPE,
+  consumeStepThroughRelease,
+  isStepThroughArmed,
+  shouldPauseForStepThrough
+} from "./step-through.js";
 const logger = createLogger("workflows");
 function normalizeWorkflowUserId(value) {
   if (typeof value !== "string") return null;
@@ -16,6 +40,15 @@ function normalizeWorkflowUserId(value) {
 function resolveWorkflowExecutionUserId(context, instance) {
   return normalizeWorkflowUserId(context?.userId) ?? normalizeWorkflowUserId(instance.metadata?.initiatedBy) ?? void 0;
 }
+async function resolveRunActorUserId(em, definition, context, instance) {
+  const fallback = resolveWorkflowExecutionUserId(context, instance);
+  const actor = await resolveWorkflowDefinitionExecutionUserId(
+    em,
+    definition,
+    fallback
+  );
+  return actor ?? void 0;
+}
 class WorkflowExecutionError extends Error {
   constructor(message, code, details) {
     super(message);
@@ -31,6 +64,7 @@ async function startWorkflow(em, options) {
     initialContext = {},
     correlationKey,
     metadata,
+    isDryRun = false,
     tenantId,
     organizationId
   } = options;
@@ -54,6 +88,14 @@ async function startWorkflow(em, options) {
       { workflowId, version: definition.version }
     );
   }
+  const minEngineVersion = definition.metadata?.minEngineVersion;
+  if (!isEngineVersionSupported(minEngineVersion)) {
+    throw new WorkflowExecutionError(
+      `Workflow definition requires engine version ${minEngineVersion}, this engine is version ${WORKFLOW_ENGINE_VERSION}`,
+      "ENGINE_VERSION_TOO_OLD",
+      { workflowId, version: definition.version, minEngineVersion, engineVersion: WORKFLOW_ENGINE_VERSION }
+    );
+  }
   const { steps, transitions } = definition.definition;
   if (!steps || steps.length < 2) {
     throw new WorkflowExecutionError(
@@ -110,6 +152,7 @@ async function startWorkflow(em, options) {
     metadata,
     startedAt: now,
     retryCount: 0,
+    isDryRun,
     tenantId,
     organizationId,
     createdAt: now,
@@ -130,6 +173,18 @@ async function startWorkflow(em, options) {
     tenantId,
     organizationId
   });
+  if (isDryRun) {
+    await logWorkflowEvent(em, {
+      workflowInstanceId: instance.id,
+      eventType: DRY_RUN_EVENT_TYPES.started,
+      eventData: { workflowId: instance.workflowId, version: instance.version },
+      userId: metadata?.initiatedBy,
+      tenantId,
+      organizationId
+    });
+  }
+  await emitInstanceLifecycleEvent(instance, "workflows.instance.created");
+  await emitInstanceLifecycleEvent(instance, "workflows.instance.started");
   return instance;
 }
 async function executeWorkflow(em, container, instanceId, context) {
@@ -173,7 +228,7 @@ async function executeWorkflow(em, container, instanceId, context) {
       }
       const maxIterations = 100;
       let iterations = 0;
-      const executionUserId = resolveWorkflowExecutionUserId(context, instance);
+      const executionUserId = await resolveRunActorUserId(trx, definition, context, instance);
       while (iterations < maxIterations) {
         iterations++;
         const currentInstance = await getWorkflowInstanceForExecution(trx, instanceId, { refresh: iterations > 1 });
@@ -214,9 +269,45 @@ async function executeWorkflow(em, container, instanceId, context) {
             executionTime: Date.now() - startTime
           };
         }
+        if (currentInstance.status === "PAUSED" || currentInstance.status === "WAITING_FOR_ACTIVITIES") {
+          return {
+            status: "RUNNING",
+            currentStep: currentInstance.currentStepId,
+            context: currentInstance.context,
+            events,
+            executionTime: Date.now() - startTime
+          };
+        }
         const currentStep = definition.definition.steps.find(
           (s) => s.stepId === currentInstance.currentStepId
         );
+        if (shouldPauseForStepThrough(
+          currentInstance,
+          currentInstance.currentStepId,
+          currentStep?.stepType
+        )) {
+          await pauseForStepThrough(trx, currentInstance);
+          events.push({
+            eventType: STEP_THROUGH_EVENT_TYPE,
+            occurredAt: /* @__PURE__ */ new Date(),
+            data: { stepId: currentInstance.currentStepId }
+          });
+          return {
+            status: "RUNNING",
+            currentStep: currentInstance.currentStepId,
+            context: currentInstance.context,
+            events,
+            executionTime: Date.now() - startTime
+          };
+        }
+        if (isStepThroughArmed(currentInstance)) {
+          currentInstance.metadata = {
+            ...currentInstance.metadata || {},
+            stepThrough: consumeStepThroughRelease()
+          };
+          currentInstance.updatedAt = /* @__PURE__ */ new Date();
+          await trx.flush();
+        }
         if (currentStep?.stepType === "END") {
           await completeWorkflow(trx, container, instanceId, "COMPLETED");
           events.push({
@@ -240,7 +331,60 @@ async function executeWorkflow(em, container, instanceId, context) {
             executionTime: Date.now() - startTime
           };
         }
-        const transitions = definition.definition.transitions.filter(
+        const outcomeMarker = readAgentOutcomeMarker(
+          currentInstance.context,
+          currentInstance.currentStepId ?? ""
+        );
+        if (outcomeMarker) {
+          const dispatched = await dispatchAgentOutcome(
+            trx,
+            container,
+            currentInstance,
+            definition.definition,
+            outcomeMarker,
+            { workflowContext: currentInstance.context, userId: executionUserId }
+          );
+          if (dispatched.kind === "routed") {
+            events.push({
+              eventType: "OUTCOME_ROUTED",
+              occurredAt: /* @__PURE__ */ new Date(),
+              data: {
+                stepId: outcomeMarker.stepId,
+                outcome: outcomeMarker.outcome,
+                toStepId: dispatched.toStepId,
+                transitionId: dispatched.transitionId
+              }
+            });
+            continue;
+          }
+          if (dispatched.kind === "failed") {
+            errors.push(dispatched.error);
+            events.push({
+              eventType: "OUTCOME_UNHANDLED",
+              occurredAt: /* @__PURE__ */ new Date(),
+              data: { stepId: outcomeMarker.stepId, outcome: outcomeMarker.outcome }
+            });
+            await completeWorkflow(trx, container, instanceId, "FAILED", { error: dispatched.error });
+            return {
+              status: "FAILED",
+              currentStep: currentInstance.currentStepId,
+              context: currentInstance.context,
+              events,
+              errors,
+              executionTime: Date.now() - startTime
+            };
+          }
+          if (dispatched.kind === "parked") {
+            return {
+              status: "RUNNING",
+              currentStep: currentInstance.currentStepId,
+              context: currentInstance.context,
+              events,
+              executionTime: Date.now() - startTime
+            };
+          }
+        }
+        const transitions = excludeNonNormalTransitions(definition.definition.transitions).filter(
           (t) => t.fromStepId === currentInstance.currentStepId && t.trigger === "auto"
         );
         if (transitions.length === 0) {
@@ -283,10 +427,79 @@ async function executeWorkflow(em, container, instanceId, context) {
             currentInstance,
             selectedTransition.fromStepId,
             selectedTransition.toStepId,
-            evalContext
+            { ...evalContext, transitionId: selectedTransition.transitionId }
           );
           if (!transitionResult.success) {
             const rejectionMessage = transitionResult.error || "Transition failed";
+            if (transitionResult.errorRoute && transitionResult.failedStepId) {
+              const routed = await followErrorRoute(
+                trx,
+                container,
+                currentInstance,
+                transitionResult.failedStepId,
+                transitionResult.errorRoute,
+                rejectionMessage,
+                evalContext
+              );
+              if (routed) {
+                events.push({
+                  eventType: "ERROR_ROUTED",
+                  occurredAt: /* @__PURE__ */ new Date(),
+                  data: {
+                    failedStepId: transitionResult.failedStepId,
+                    toStepId: transitionResult.errorRoute.toStepId,
+                    transitionId: transitionResult.errorRoute.transitionId
+                  }
+                });
+                continue;
+              }
+              errors.push(`Error route from ${transitionResult.failedStepId} could not be followed`);
+            }
+            if (transitionResult.errorHandlerStepId && transitionResult.failedStepId) {
+              const entered = await enterErrorHandlerStep(
+                trx,
+                container,
+                currentInstance,
+                transitionResult.failedStepId,
+                transitionResult.errorHandlerStepId,
+                rejectionMessage,
+                executionUserId
+              );
+              if (entered) {
+                events.push({
+                  eventType: "ERROR_HANDLER_STARTED",
+                  occurredAt: /* @__PURE__ */ new Date(),
+                  data: {
+                    failedStepId: transitionResult.failedStepId,
+                    handlerStepId: transitionResult.errorHandlerStepId
+                  }
+                });
+                continue;
+              }
+              errors.push(
+                `Error handler step ${transitionResult.errorHandlerStepId} could not be entered`
+              );
+            }
+            if (transitionResult.parkForAttention && transitionResult.failedStepId) {
+              await parkInstanceForAttention(
+                trx,
+                currentInstance,
+                transitionResult.failedStepId,
+                rejectionMessage
+              );
+              events.push({
+                eventType: "ERROR_PARKED",
+                occurredAt: /* @__PURE__ */ new Date(),
+                data: { failedStepId: transitionResult.failedStepId }
+              });
+              return {
+                status: "RUNNING",
+                currentStep: currentInstance.currentStepId,
+                context: currentInstance.context,
+                events,
+                executionTime: Date.now() - startTime
+              };
+            }
             logger.error("Transition rejected", {
               instanceId: currentInstance.id,
               workflowId: currentInstance.workflowId,
@@ -320,6 +533,10 @@ async function executeWorkflow(em, container, instanceId, context) {
               transitionId: selectedTransition.transitionId
             }
           });
+          await emitInstanceLifecycleEvent(currentInstance, "workflows.instance.started", {
+            stepId: selectedTransition.toStepId,
+            fromStepId: selectedTransition.fromStepId
+          });
           if (transitionResult.pausedForActivities) {
             await logWorkflowEvent(trx, {
               workflowInstanceId: currentInstance.id,
@@ -349,6 +566,15 @@ async function executeWorkflow(em, container, instanceId, context) {
               executionTime: Date.now() - startTime
             };
           }
+          if (transitionResult.paused) {
+            return {
+              status: "RUNNING",
+              currentStep: currentInstance.currentStepId,
+              context: currentInstance.context,
+              events,
+              executionTime: Date.now() - startTime
+            };
+          }
           await trx.flush();
         } catch (error) {
           const errorMessage = error instanceof Error ? error.message : String(error);
@@ -406,6 +632,7 @@ async function executeWorkflow(em, container, instanceId, context) {
           instance.errorMessage = errorMessage;
           instance.errorDetails = error instanceof WorkflowExecutionError ? error.details : void 0;
           instance.updatedAt = /* @__PURE__ */ new Date();
+          await writeRunOutcome(trx, instance, "FAILED");
           await trx.flush();
           await logWorkflowEvent(trx, {
             workflowInstanceId: instanceId,
@@ -421,7 +648,301 @@ async function executeWorkflow(em, container, instanceId, context) {
       throw error;
     }
   };
-  return typeof transactionalEm.transactional === "function" ? transactionalEm.transactional((trx) => runExecution(trx)) : runExecution(em);
+  if (typeof transactionalEm.transactional !== "function") {
+    return runExecution(em);
+  }
+  try {
+    return await transactionalEm.transactional((trx) => runExecution(trx));
+  } catch (error) {
+    await persistFailedStatusAfterRollback(em, instanceId, error);
+    throw error;
+  }
+}
+async function dispatchAgentOutcomeForCurrentStep(em, container, instance, definition, evalContext) {
+  const marker = readAgentOutcomeMarker(instance.context, instance.currentStepId ?? "");
+  if (!marker) return null;
+  return await dispatchAgentOutcome(em, container, instance, definition, marker, evalContext);
+}
+async function dispatchAgentOutcome(em, container, instance, definition, marker, evalContext) {
+  const { [WORKFLOW_AGENT_OUTCOME_CONTEXT_KEY]: _consumed, ...remainingContext } = instance.context || {};
+  instance.context = remainingContext;
+  instance.updatedAt = /* @__PURE__ */ new Date();
+  await em.flush();
+  const clearedEvalContext = {
+    ...evalContext,
+    workflowContext: remainingContext
+  };
+  const failUnhandled = async (error) => {
+    await logWorkflowEvent(em, {
+      workflowInstanceId: instance.id,
+      eventType: "OUTCOME_UNHANDLED",
+      eventData: { stepId: marker.stepId, outcome: marker.outcome, error },
+      tenantId: instance.tenantId,
+      organizationId: instance.organizationId
+    });
+    return { kind: "failed", error };
+  };
+  const handling = resolveAgentOutcomeHandling(definition, marker.stepId, marker.outcome);
+  if (handling.kind === "default") return { kind: "default" };
+  if (handling.kind === "route") {
+    const toStepId = handling.transition.toStepId;
+    if (!toStepId) return { kind: "default" };
+    await logWorkflowEvent(em, {
+      workflowInstanceId: instance.id,
+      eventType: "OUTCOME_ROUTED",
+      eventData: {
+        stepId: marker.stepId,
+        outcome: marker.outcome,
+        toStepId,
+        transitionId: handling.transition.transitionId,
+        proposalId: marker.proposalId
+      },
+      tenantId: instance.tenantId,
+      organizationId: instance.organizationId
+    });
+    const transitionHandler = await import("./transition-handler.js");
+    const routed = await transitionHandler.executeTransition(
+      em,
+      container,
+      instance,
+      marker.stepId,
+      toStepId,
+      { ...clearedEvalContext, transitionId: handling.transition.transitionId }
+    );
+    if (routed.success) {
+      return {
+        kind: "routed",
+        toStepId,
+        transitionId: handling.transition.transitionId,
+        paused: routed.paused
+      };
+    }
+    return await failUnhandled(`Outcome route for "${marker.outcome}" could not be followed`);
+  }
+  const unhandled = `Agent step ${marker.stepId} resolved outcome "${marker.outcome}", which is not wired`;
+  if (handling.handling.kind === "route") {
+    const errorRoute = handling.handling.transition;
+    if (errorRoute.toStepId) {
+      const routed = await followErrorRoute(
+        em,
+        container,
+        instance,
+        marker.stepId,
+        { transitionId: errorRoute.transitionId, toStepId: errorRoute.toStepId },
+        unhandled,
+        clearedEvalContext
+      );
+      if (routed) {
+        return {
+          kind: "routed",
+          toStepId: errorRoute.toStepId,
+          transitionId: errorRoute.transitionId,
+          paused: instance.status === "PAUSED"
+        };
+      }
+    }
+  }
+  if (handling.handling.kind === "continue") {
+    await logWorkflowEvent(em, {
+      workflowInstanceId: instance.id,
+      eventType: "ERROR_DIRECTIVE_APPLIED",
+      eventData: {
+        stepId: marker.stepId,
+        directive: "continueWithFallback",
+        source: "agentOutcome",
+        hasFallbackValue: handling.handling.fallbackValue !== void 0
+      },
+      tenantId: instance.tenantId,
+      organizationId: instance.organizationId
+    });
+    if (handling.handling.fallbackValue !== void 0) {
+      instance.context = {
+        ...instance.context || {},
+        [marker.stepId]: handling.handling.fallbackValue
+      };
+      instance.updatedAt = /* @__PURE__ */ new Date();
+      await em.flush();
+    }
+    return { kind: "default" };
+  }
+  if (handling.handling.kind === "park") {
+    await parkInstanceForAttention(em, instance, marker.stepId, unhandled);
+    return { kind: "parked" };
+  }
+  if (handling.handling.kind === "handlerStep") {
+    const entered = await enterErrorHandlerStep(
+      em,
+      container,
+      instance,
+      marker.stepId,
+      handling.handling.stepId,
+      unhandled,
+      clearedEvalContext.userId
+    );
+    if (entered) {
+      return {
+        kind: "routed",
+        toStepId: handling.handling.stepId,
+        paused: instance.status === "PAUSED"
+      };
+    }
+  }
+  return await failUnhandled(unhandled);
+}
+async function followErrorRoute(em, container, instance, failedStepId, errorRoute, error, evalContext) {
+  await logWorkflowEvent(em, {
+    workflowInstanceId: instance.id,
+    eventType: "ERROR_ROUTED",
+    eventData: {
+      failedStepId,
+      toStepId: errorRoute.toStepId,
+      transitionId: errorRoute.transitionId,
+      error
+    },
+    tenantId: instance.tenantId,
+    organizationId: instance.organizationId
+  });
+  const errorEntry = buildErrorContextEntry(failedStepId, error);
+  instance.context = {
+    ...instance.context || {},
+    [WORKFLOW_ERROR_CONTEXT_KEY]: errorEntry
+  };
+  instance.updatedAt = /* @__PURE__ */ new Date();
+  await em.flush();
+  const transitionHandler = await import("./transition-handler.js");
+  const routedResult = await transitionHandler.executeTransition(
+    em,
+    container,
+    instance,
+    failedStepId,
+    errorRoute.toStepId,
+    {
+      ...evalContext,
+      workflowContext: {
+        ...evalContext.workflowContext,
+        [WORKFLOW_ERROR_CONTEXT_KEY]: errorEntry
+      },
+      transitionId: errorRoute.transitionId
+    }
+  );
+  return routedResult.success === true;
+}
+async function enterErrorHandlerStep(em, container, instance, failedStepId, handlerStepId, error, userId) {
+  const errorEntry = buildErrorContextEntry(failedStepId, error);
+  await logWorkflowEvent(em, {
+    workflowInstanceId: instance.id,
+    eventType: "ERROR_HANDLER_STARTED",
+    eventData: { failedStepId, handlerStepId, error },
+    tenantId: instance.tenantId,
+    organizationId: instance.organizationId
+  });
+  instance.context = {
+    ...instance.context || {},
+    [WORKFLOW_ERROR_CONTEXT_KEY]: errorEntry
+  };
+  instance.currentStepId = handlerStepId;
+  instance.updatedAt = /* @__PURE__ */ new Date();
+  await em.flush();
+  const { executeStep } = await import("./step-handler.js");
+  const result = await executeStep(
+    em,
+    instance,
+    handlerStepId,
+    {
+      workflowContext: {
+        ...instance.context || {},
+        [WORKFLOW_ERROR_CONTEXT_KEY]: errorEntry
+      },
+      userId
+    },
+    container
+  );
+  return result.status !== "FAILED";
+}
+async function pauseForStepThrough(em, instance) {
+  const now = /* @__PURE__ */ new Date();
+  instance.status = "PAUSED";
+  instance.pausedAt = now;
+  instance.updatedAt = now;
+  await em.flush();
+  await logWorkflowEvent(em, {
+    workflowInstanceId: instance.id,
+    eventType: STEP_THROUGH_EVENT_TYPE,
+    eventData: { stepId: instance.currentStepId },
+    tenantId: instance.tenantId,
+    organizationId: instance.organizationId
+  });
+}
+async function parkInstanceForAttention(em, instance, failedStepId, error) {
+  const now = /* @__PURE__ */ new Date();
+  instance.status = "PAUSED";
+  instance.pausedAt = now;
+  instance.errorMessage = error;
+  instance.metadata = {
+    ...instance.metadata || {},
+    attention: {
+      reason: "ERROR_DIRECTIVE",
+      stepId: failedStepId,
+      error,
+      at: now.toISOString()
+    }
+  };
+  instance.updatedAt = now;
+  await em.flush();
+  await logWorkflowEvent(em, {
+    workflowInstanceId: instance.id,
+    eventType: "ERROR_PARKED",
+    eventData: { failedStepId, error, directive: "failureQueue" },
+    tenantId: instance.tenantId,
+    organizationId: instance.organizationId
+  });
+}
+async function persistFailedStatusAfterRollback(em, instanceId, error) {
+  const errorMessage = error instanceof Error ? error.message : String(error);
+  const errorDetails = error instanceof WorkflowExecutionError ? error.details : void 0;
+  const markFailed = async (trx) => {
+    const instance = await trx.findOne(
+      WorkflowInstance,
+      { id: instanceId },
+      { lockMode: LockMode.PESSIMISTIC_WRITE }
+    );
+    if (!instance || instance.status !== "RUNNING") return;
+    instance.status = "FAILED";
+    instance.errorMessage = errorMessage;
+    instance.errorDetails = errorDetails;
+    instance.updatedAt = /* @__PURE__ */ new Date();
+    await writeRunOutcome(trx, instance, "FAILED");
+    await trx.flush();
+    await logWorkflowEvent(trx, {
+      workflowInstanceId: instanceId,
+      eventType: "WORKFLOW_FAILED",
+      eventData: { error: errorMessage },
+      tenantId: instance.tenantId,
+      organizationId: instance.organizationId
+    });
+    await emitInstanceLifecycleEvent(instance, "workflows.instance.failed");
+  };
+  try {
+    if (typeof em.fork !== "function") return;
+    const fork = em.fork();
+    if (typeof fork.transactional === "function") {
+      await fork.transactional((trx) => markFailed(trx));
+    } else {
+      await markFailed(fork);
+    }
+  } catch (persistError) {
+    logger.error("failed to durably persist FAILED status after rollback", {
+      instanceId,
+      error: persistError instanceof Error ? persistError.message : String(persistError)
+    });
+  }
+}
+async function writeRunOutcome(em, instance, terminalStatus) {
+  const evidence = await collectRunOutcomeEvidence(em, instance, terminalStatus);
+  instance.outcome = resolveRunOutcome(evidence);
+  if (terminalStatus !== "CANCELLED" && !instance.completedAt) {
+    instance.completedAt = /* @__PURE__ */ new Date();
+  }
 }
 async function completeWorkflow(em, container, instanceId, status, result) {
   const instance = await getWorkflowInstance(em, instanceId);
@@ -432,6 +953,13 @@ async function completeWorkflow(em, container, instanceId, status, result) {
       { instanceId }
     );
   }
+  if (status === "FAILED") {
+    await scheduleWorkflowErrorHandler(em, instance, {
+      failedStepId: result?.failedStepId ?? instance.currentStepId,
+      error: result?.error,
+      details: result?.details
+    });
+  }
   if (status === "FAILED") {
     const definition = await findDefinitionForInstance(em, instance);
     if (definition && checkIfCompensationNeeded(definition)) {
@@ -456,6 +984,10 @@ async function completeWorkflow(em, container, instanceId, status, result) {
           compensatedActivities: compensationResult.compensatedActivities,
           totalActivities: compensationResult.totalActivities
         });
+        await writeRunOutcome(em, instance, instance.status);
+        await em.flush();
+        await enqueueSubWorkflowParentResume(instance, "FAILED");
+        await emitInstanceLifecycleEvent(instance, "workflows.instance.failed");
         return;
       } catch (error) {
         logger.error("Compensation failed with exception", { err: error });
@@ -483,6 +1015,7 @@ async function completeWorkflow(em, container, instanceId, status, result) {
       instance.cancelledAt = now;
       break;
   }
+  await writeRunOutcome(em, instance, status);
   await em.flush();
   const eventType = status === "COMPLETED" ? "WORKFLOW_COMPLETED" : status === "FAILED" ? "WORKFLOW_FAILED" : "WORKFLOW_CANCELLED";
   await logWorkflowEvent(em, {
@@ -492,6 +1025,46 @@ async function completeWorkflow(em, container, instanceId, status, result) {
     tenantId: instance.tenantId,
     organizationId: instance.organizationId
   });
+  await emitInstanceLifecycleEvent(
+    instance,
+    status === "COMPLETED" ? "workflows.instance.completed" : status === "FAILED" ? "workflows.instance.failed" : "workflows.instance.cancelled"
+  );
+  if (status === "COMPLETED" || status === "FAILED") {
+    await enqueueSubWorkflowParentResume(instance, status);
+  }
+}
+async function enqueueSubWorkflowParentResume(instance, childStatus) {
+  const labels = instance.metadata?.labels;
+  const parentInstanceId = labels?.parentInstanceId;
+  const parentStepId = labels?.parentStepId;
+  const parentStepInstanceId = labels?.parentStepInstanceId;
+  if (!parentInstanceId || !parentStepId || !parentStepInstanceId) return;
+  try {
+    const { createModuleQueue } = await import("@open-mercato/queue");
+    const { WORKFLOW_ACTIVITIES_QUEUE_NAME } = await import("./activity-queue-types.js");
+    const { INVOKE_AGENT_ENQUEUE_DELAY_MS } = await import("./activity-executor.js");
+    const queue = createModuleQueue(WORKFLOW_ACTIVITIES_QUEUE_NAME, {
+      concurrency: parseInt(process.env.WORKFLOW_WORKER_CONCURRENCY || "5")
+    });
+    const job = {
+      kind: "resume_subworkflow_parent",
+      workflowInstanceId: parentInstanceId,
+      parentInstanceId,
+      parentStepId,
+      parentStepInstanceId,
+      childInstanceId: instance.id,
+      childStatus,
+      tenantId: instance.tenantId,
+      organizationId: instance.organizationId
+    };
+    await queue.enqueue(job, { delayMs: INVOKE_AGENT_ENQUEUE_DELAY_MS });
+  } catch (error) {
+    logger.error("failed to enqueue parent-resume job", {
+      childInstanceId: instance.id,
+      parentInstanceId,
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
 }
 async function resumeWorkflowAfterActivities(em, container, instanceId, branchInstanceId) {
   const transactionalEm = em;
@@ -541,6 +1114,7 @@ async function resumeWorkflowAfterActivities(em, container, instanceId, branchIn
           jobId: e.eventData.jobId
         }))
       };
+      await writeRunOutcome(trx, instance, "FAILED");
       await trx.flush();
       await logWorkflowEvent(trx, {
         workflowInstanceId: instanceId,
@@ -625,6 +1199,7 @@ async function resumeWorkflowAfterActivities(em, container, instanceId, branchIn
       tenantId: instance.tenantId,
       organizationId: instance.organizationId
     });
+    const resumeDefinition = await findDefinitionForInstance(trx, instance);
     const { executeStep } = await import("./step-handler.js");
     await executeStep(
       trx,
@@ -632,7 +1207,7 @@ async function resumeWorkflowAfterActivities(em, container, instanceId, branchIn
       pendingTransition.toStepId,
       {
         workflowContext: instance.context || {},
-        userId: resolveWorkflowExecutionUserId(void 0, instance)
+        userId: resumeDefinition ? await resolveRunActorUserId(trx, resumeDefinition, void 0, instance) : resolveWorkflowExecutionUserId(void 0, instance)
       },
       container
     );
@@ -691,6 +1266,79 @@ async function updateWorkflowContext(em, instanceId, updates) {
   instance.updatedAt = /* @__PURE__ */ new Date();
   await em.flush();
 }
+const RESERVED_WORKFLOW_CONTEXT_KEYS = [
+  "__result",
+  "_pendingAsyncActivities",
+  "__park",
+  WORKFLOW_ERROR_CONTEXT_KEY
+];
+function findReservedContextKeys(updates) {
+  return Object.keys(updates).filter((key) => RESERVED_WORKFLOW_CONTEXT_KEYS.includes(key));
+}
+async function updateWorkflowContextScoped(em, options) {
+  const { instanceId, tenantId, organizationId, updates, assertVersion } = options;
+  const reserved = findReservedContextKeys(updates);
+  if (reserved.length > 0) {
+    throw new WorkflowExecutionError(
+      `Reserved workflow context keys cannot be written: ${reserved.join(", ")}`,
+      "RESERVED_CONTEXT_KEY",
+      { instanceId, reserved }
+    );
+  }
+  const instance = await findOneWithDecryption(
+    em,
+    WorkflowInstance,
+    { id: instanceId, tenantId, organizationId },
+    void 0,
+    { tenantId, organizationId }
+  );
+  if (!instance) {
+    throw new WorkflowExecutionError(
+      `Workflow instance not found: ${instanceId}`,
+      "INSTANCE_NOT_FOUND",
+      { instanceId }
+    );
+  }
+  if (instance.status !== "RUNNING" && instance.status !== "PAUSED" && instance.status !== "FORKED") {
+    throw new WorkflowExecutionError(
+      `Workflow instance is not accepting context updates: ${instance.status}`,
+      "INSTANCE_NOT_UPDATABLE",
+      { instanceId, status: instance.status }
+    );
+  }
+  if (assertVersion) await assertVersion(instance.updatedAt);
+  instance.context = {
+    ...instance.context,
+    ...updates
+  };
+  instance.updatedAt = /* @__PURE__ */ new Date();
+  await em.flush();
+  return instance;
+}
+async function emitInstanceLifecycleEvent(instance, eventId, extra) {
+  try {
+    await emitWorkflowsEvent(
+      eventId,
+      {
+        id: instance.id,
+        tenantId: instance.tenantId,
+        organizationId: instance.organizationId,
+        workflowId: instance.workflowId,
+        version: instance.version,
+        status: instance.status,
+        stepId: instance.currentStepId ?? null,
+        ...extra
+      },
+      { persistent: true }
+    );
+  } catch (error) {
+    logger.error("failed to emit workflow event", {
+      eventId,
+      instanceId: instance.id,
+      error: error instanceof Error ? error.message : String(error)
+    });
+  }
+}
 async function logWorkflowEvent(em, event) {
   const workflowEvent = em.create(WorkflowEvent, {
     ...event,
@@ -700,12 +1348,16 @@ async function logWorkflowEvent(em, event) {
   return workflowEvent;
 }
 export {
+  RESERVED_WORKFLOW_CONTEXT_KEYS,
   WorkflowExecutionError,
   completeWorkflow,
+  dispatchAgentOutcomeForCurrentStep,
   executeWorkflow,
+  findReservedContextKeys,
   getWorkflowInstance,
   resumeWorkflowAfterActivities,
   startWorkflow,
-  updateWorkflowContext
+  updateWorkflowContext,
+  updateWorkflowContextScoped
 };
 //# sourceMappingURL=workflow-executor.js.map