@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/dist/modules/workflows/lib/activity-executor.js

@@ -5,12 +5,46 @@ import {
 } from "@open-mercato/shared/lib/url-safety";
 import { parseBooleanWithDefault } from "@open-mercato/shared/lib/boolean";
 import { isPrivateCrossProcessBroadcastEvent } from "@open-mercato/shared/modules/events";
-import { callWebhookConfigSchema } from "../data/validators.js";
-import { WORKFLOW_ACTIVITIES_QUEUE_NAME } from "./activity-queue-types.js";
+import {
+  definitionDeclaresGrant,
+  resolveWorkflowDefinitionExecutionUserId
+} from "./definition-grant.js";
+import {
+  callWebhookConfigSchema,
+  invokeAgentConfigSchema,
+  setVariableConfigSchema
+} from "../data/activity-config-schemas.js";
+import {
+  buildSetVariableContextPatch,
+  isSetVariableOutput,
+  splitAssignmentPath
+} from "./set-variable.js";
+import {
+  DRY_RUN_EVENT_TYPES,
+  WorkflowDryRunRefusalError,
+  isDryRunInstance,
+  isDryRunRefusal
+} from "./dry-run.js";
+import {
+  applyTransforms,
+  parseInterpolationToken
+} from "./interpolation-pipeline.js";
+import { resolveDefinitionInterpolationMode } from "./interpolation-pipeline.js";
+import {
+  WORKFLOW_ACTIVITIES_QUEUE_NAME,
+  WORKFLOW_INVOKE_AGENT_QUEUE_NAME
+} from "./activity-queue-types.js";
+import "./activity-registry-bootstrap.js";
+import { bindActivityExecutor } from "./activity-types.js";
+import { getActivityType } from "./activity-registry.js";
 import { logWorkflowEvent } from "./event-logger.js";
-import { parseDuration } from "./duration.js";
+import { calculateWaitDelayMs } from "./duration.js";
+import { calculateWaitDelayMs as calculateWaitDelayMs2 } from "./duration.js";
 import { resolveActivityTimeoutMs } from "./activityTimeoutFields.js";
 import { getWorkflowSafeCommand } from "./workflow-safe-commands.js";
+import { isWorkflowCommandEnabled } from "./workflow-command-enablement.js";
+import { resolveWorkflowCommandPolicyForContainer } from "./workflow-command-settings.js";
+import { resolveAgentReview, toAgentDispositionReview } from "./agent-review.js";
 import { isPrivateUrl } from "@open-mercato/shared/lib/network";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("workflows");
@@ -49,11 +83,17 @@ function getWorkflowEnvInterpolationAllowlist() {
   }
   return allowlist;
 }
-function resolveWorkflowEnvInterpolation(envKey) {
-  if (!getWorkflowEnvInterpolationAllowlist().has(envKey)) {
-    return "";
+const INVOKE_AGENT_SIGNAL_NAME = "agent_orchestrator.proposal.ready";
+const SUB_WORKFLOW_SIGNAL_NAME = "workflows.sub_workflow.completed";
+const INVOKE_AGENT_ENQUEUE_DELAY_MS = 1e3;
+function getActivityParkMarker(output) {
+  if (output && typeof output === "object" && "__park" in output) {
+    const park = output.__park;
+    if (park && typeof park === "object" && typeof park.signalName === "string") {
+      return { signalName: park.signalName };
+    }
   }
-  return process.env[envKey] ?? "";
+  return null;
 }
 async function workflowUserHasAllFeatures(container, userId, required, tenantId, organizationId) {
   try {
@@ -74,7 +114,15 @@ class ActivityExecutionError extends Error {
     this.name = "ActivityExecutionError";
   }
 }
+class WorkflowInterpolationError extends Error {
+  constructor(message, token) {
+    super(message);
+    this.token = token;
+    this.name = "WorkflowInterpolationError";
+  }
+}
 let activityQueue = null;
+let invokeAgentQueue = null;
 function getActivityQueue() {
   if (!activityQueue) {
     activityQueue = createModuleQueue(
@@ -84,9 +132,31 @@ function getActivityQueue() {
   }
   return activityQueue;
 }
+function getInvokeAgentQueue() {
+  if (!invokeAgentQueue) {
+    invokeAgentQueue = createModuleQueue(
+      WORKFLOW_INVOKE_AGENT_QUEUE_NAME,
+      { concurrency: parseInt(process.env.WORKERS_WORKFLOW_INVOKE_AGENT_CONCURRENCY || "5", 10) }
+    );
+  }
+  return invokeAgentQueue;
+}
 async function enqueueActivity(em, activity, context) {
   const { workflowInstance, workflowContext, stepContext, transitionId, stepInstanceId, branchInstanceId } = context;
-  const interpolatedConfig = interpolateVariables(activity.config, workflowContext, workflowInstance);
+  const registryEntry = getActivityType(activity.activityType);
+  if (registryEntry && registryEntry.async.capable === false) {
+    throw new ActivityExecutionError(
+      `[internal] Activity type ${activity.activityType} cannot run asynchronously (${registryEntry.async.reason})`,
+      activity.activityType,
+      activity.activityName
+    );
+  }
+  const interpolatedConfig = interpolateActivityConfig(
+    activity.config,
+    context,
+    activity.activityType,
+    activity.activityName
+  );
   const job = {
     workflowInstanceId: workflowInstance.id,
     stepInstanceId,
@@ -105,7 +175,8 @@ async function enqueueActivity(em, activity, context) {
     userId: context.userId
   };
   const queue = getActivityQueue();
-  const enqueueOptions = activity.activityType === "WAIT" && (interpolatedConfig.duration || interpolatedConfig.until) ? { delayMs: calculateWaitDelayMs(interpolatedConfig) } : void 0;
+  const registryDelayMs = registryEntry?.enqueueDelayMs ? registryEntry.enqueueDelayMs(interpolatedConfig) : null;
+  const enqueueOptions = registryDelayMs !== null ? { delayMs: registryDelayMs } : void 0;
   const jobId = await queue.enqueue(job, enqueueOptions);
   await logWorkflowEvent(em, {
     workflowInstanceId: workflowInstance.id,
@@ -141,6 +212,67 @@ async function enqueueTimerJob(params) {
   );
   return jobId;
 }
+async function enqueueTaskSlaJob(params) {
+  const {
+    workflowInstanceId,
+    stepInstanceId,
+    branchInstanceId,
+    userTaskId,
+    phase,
+    deadlineAt,
+    fireAt,
+    delayMs,
+    tenantId,
+    organizationId,
+    userId
+  } = params;
+  const queue = getActivityQueue();
+  return await queue.enqueue(
+    {
+      kind: "task_sla",
+      workflowInstanceId,
+      stepInstanceId,
+      branchInstanceId: branchInstanceId ?? void 0,
+      userTaskId,
+      phase,
+      deadlineAt,
+      fireAt,
+      tenantId,
+      organizationId,
+      userId
+    },
+    { delayMs: delayMs > 0 ? delayMs : void 0 }
+  );
+}
+async function enqueueConditionCheckJob(params) {
+  const {
+    workflowInstanceId,
+    stepInstanceId,
+    branchInstanceId,
+    tenantId,
+    organizationId,
+    userId,
+    deadlineAt,
+    attempt,
+    delayMs
+  } = params;
+  const queue = getActivityQueue();
+  const jobId = await queue.enqueue(
+    {
+      kind: "condition",
+      workflowInstanceId,
+      stepInstanceId,
+      branchInstanceId: branchInstanceId ?? void 0,
+      tenantId,
+      organizationId,
+      userId,
+      deadlineAt,
+      attempt
+    },
+    { delayMs: delayMs > 0 ? delayMs : void 0 }
+  );
+  return jobId;
+}
 async function executeActivity(em, container, activity, context) {
   const retryPolicy = activity.retryPolicy || {
     maxAttempts: 1,
@@ -172,6 +304,7 @@ async function executeActivity(em, container, activity, context) {
     } catch (error) {
       lastError = error;
       retryCount = attempt + 1;
+      if (isDryRunRefusal(error)) break;
       if (attempt < retryPolicy.maxAttempts - 1) {
         logger.error("Activity failed; will retry", {
           activityId: activity.activityId,
@@ -194,6 +327,19 @@ async function executeActivity(em, container, activity, context) {
     }
   }
   const errorMessage = lastError instanceof Error ? lastError.message : String(lastError);
+  if (isDryRunRefusal(lastError)) {
+    return {
+      activityId: activity.activityId,
+      activityName: activity.activityName,
+      activityType: activity.activityType,
+      success: false,
+      dryRunRefused: true,
+      error: `Dry run stopped: activity type ${lastError.activityType} cannot be simulated (${lastError.reason})`,
+      retryCount: 0,
+      executionTimeMs: 0,
+      async: activity.async || false
+    };
+  }
   logger.error("Activity failed after all attempts", {
     activityId: activity.activityId,
     activityType: activity.activityType,
@@ -214,9 +360,10 @@ async function executeActivity(em, container, activity, context) {
 }
 async function executeActivities(em, container, activities, context) {
   const results = [];
+  const forceSynchronous = isDryRunInstance(context.workflowInstance);
   for (let i = 0; i < activities.length; i++) {
     const activity = activities[i];
-    if (activity.async) {
+    if (activity.async && !forceSynchronous) {
       const jobId = await enqueueActivity(em, activity, context);
       results.push({
         activityId: activity.activityId,
@@ -230,46 +377,88 @@ async function executeActivities(em, container, activities, context) {
         executionTimeMs: 0
       });
     } else {
-      const result = await executeActivity(em, container, activity, context);
+      const executed = await executeActivity(em, container, activity, context);
+      const result = forceSynchronous && activity.async ? { ...executed, async: false } : executed;
       results.push(result);
       if (!result.success) {
         break;
       }
       if (result.output && typeof result.output === "object") {
-        const key = activity.activityName || activity.activityType;
-        context.workflowContext = {
-          ...context.workflowContext,
-          [key]: result.output
-        };
+        if (activity.activityType === "SET_VARIABLE" && isSetVariableOutput(result.output)) {
+          context.workflowContext = {
+            ...context.workflowContext,
+            ...buildSetVariableContextPatch(context.workflowContext, result.output.assignments)
+          };
+        } else {
+          const key = activity.activityName || activity.activityType;
+          context.workflowContext = {
+            ...context.workflowContext,
+            [key]: result.output
+          };
+        }
       }
     }
   }
   return results;
 }
 async function executeActivityByType(em, container, activity, context, signal) {
-  const interpolatedConfig = interpolateVariables(activity.config, context.workflowContext, context.workflowInstance);
-  switch (activity.activityType) {
-    case "SEND_EMAIL":
-      return await executeSendEmail(interpolatedConfig, context, container);
-    case "CALL_API":
-      return await executeCallApi(em, interpolatedConfig, context, container, signal);
-    case "EMIT_EVENT":
-      return await executeEmitEvent(interpolatedConfig, context, container);
-    case "UPDATE_ENTITY":
-      return await executeUpdateEntity(em, interpolatedConfig, context, container);
-    case "CALL_WEBHOOK":
-      return await executeCallWebhook(interpolatedConfig, context, { signal });
-    case "EXECUTE_FUNCTION":
-      return await executeFunction(interpolatedConfig, context, container);
-    case "WAIT":
-      return await executeWait(interpolatedConfig);
-    default:
-      throw new ActivityExecutionError(
-        `Unknown activity type: ${activity.activityType}`,
+  const interpolatedConfig = interpolateActivityConfig(
+    activity.config,
+    context,
+    activity.activityType,
+    activity.activityName
+  );
+  const entry = getActivityType(activity.activityType);
+  if (!entry) {
+    throw new ActivityExecutionError(
+      `Unknown activity type: ${activity.activityType}`,
+      activity.activityType,
+      activity.activityName
+    );
+  }
+  if (isDryRunInstance(context.workflowInstance)) {
+    if (entry.mock === "refuse" || entry.mock === void 0) {
+      const refusal = new WorkflowDryRunRefusalError(
         activity.activityType,
+        entry.mock === "refuse" ? "refused" : "noMock",
         activity.activityName
       );
+      await logWorkflowEvent(em, {
+        workflowInstanceId: context.workflowInstance.id,
+        stepInstanceId: context.stepInstanceId,
+        eventType: DRY_RUN_EVENT_TYPES.activityRefused,
+        eventData: {
+          activityId: activity.activityId,
+          activityName: activity.activityName,
+          activityType: activity.activityType,
+          reason: refusal.reason
+        },
+        tenantId: context.workflowInstance.tenantId,
+        organizationId: context.workflowInstance.organizationId
+      });
+      throw refusal;
+    }
+    const simulated = entry.mock(interpolatedConfig, context);
+    await logWorkflowEvent(em, {
+      workflowInstanceId: context.workflowInstance.id,
+      stepInstanceId: context.stepInstanceId,
+      eventType: DRY_RUN_EVENT_TYPES.activitySimulated,
+      eventData: {
+        activityId: activity.activityId,
+        activityName: activity.activityName,
+        activityType: activity.activityType,
+        output: simulated ?? null
+      },
+      tenantId: context.workflowInstance.tenantId,
+      organizationId: context.workflowInstance.organizationId
+    });
+    return simulated;
   }
+  return await entry.execute(interpolatedConfig, context, {
+    em,
+    container,
+    signal
+  });
 }
 async function executeSendEmail(config, context, container) {
   const { to, subject, template, templateData, body } = config;
@@ -277,21 +466,24 @@ async function executeSendEmail(config, context, container) {
     throw new Error('SEND_EMAIL requires "to" and "subject" fields');
   }
   logger.info("Send email activity invoked", { component: "SEND_EMAIL", subject });
+  let emailService;
   try {
-    const emailService = container.resolve("emailService");
-    if (emailService && typeof emailService.send === "function") {
-      await emailService.send({
-        to,
-        subject,
-        template,
-        templateData,
-        body
-      });
-      return { sent: true, to, subject, via: "emailService" };
-    }
-  } catch (error) {
+    emailService = container.resolve("emailService");
+  } catch {
+    emailService = void 0;
+  }
+  if (emailService && typeof emailService.send === "function") {
+    await emailService.send({
+      to,
+      subject,
+      template,
+      templateData,
+      body
+    });
+    return { sent: true, to, subject, via: "emailService" };
   }
-  return { sent: true, to, subject, via: "console" };
+  logger.warn("SEND_EMAIL has no registered email service; email was not sent", { component: "SEND_EMAIL", subject });
+  return { sent: false, simulated: true, to, subject, via: "console", reason: "no-email-service" };
 }
 async function executeEmitEvent(config, context, container) {
   const { eventName, payload } = config;
@@ -350,6 +542,13 @@ async function executeUpdateEntity(em, config, context, container) {
   if (!workflowSafeCommand) {
     throw new Error("UPDATE_ENTITY command is not allowed");
   }
+  const commandPolicy = await resolveWorkflowCommandPolicyForContainer(
+    container,
+    context.workflowInstance.tenantId
+  );
+  if (!isWorkflowCommandEnabled(workflowSafeCommand, commandPolicy)) {
+    throw new Error("UPDATE_ENTITY command is not enabled for this tenant");
+  }
   if (!input || typeof input !== "object") {
     throw new Error('UPDATE_ENTITY requires "input" object with entity data');
   }
@@ -528,27 +727,122 @@ async function executeFunction(config, context, container) {
     throw error;
   }
 }
-function calculateWaitDelayMs(config) {
-  if (config.until) {
-    const targetDate = new Date(config.until);
-    if (isNaN(targetDate.getTime())) {
-      throw new Error(`WAIT activity: invalid "until" datetime: ${config.until}`);
-    }
-    const delayMs = targetDate.getTime() - Date.now();
-    return Math.max(0, delayMs);
-  }
-  if (config.duration) {
-    return parseDuration(config.duration);
-  }
-  throw new Error('WAIT activity requires "duration" (e.g., "PT5M", "1h") or "until" (ISO 8601 datetime)');
-}
 async function executeWait(config) {
   const durationMs = calculateWaitDelayMs(config);
   await sleep(durationMs);
   return { waited: true, durationMs };
 }
+async function executeSetVariable(config, context) {
+  const parsed = setVariableConfigSchema.safeParse(config);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((issue) => `${issue.path.join(".") || "config"}: ${issue.message}`).join("; ");
+    throw new Error(`SET_VARIABLE config invalid: ${issues}`);
+  }
+  for (const assignment of parsed.data.assignments) {
+    const segments = splitAssignmentPath(assignment.path);
+    if (segments === null) {
+      throw new Error(
+        `SET_VARIABLE assignment path contains a forbidden segment (__proto__, constructor, prototype): "${assignment.path}"`
+      );
+    }
+    if (segments.length === 0) {
+      throw new Error(`SET_VARIABLE assignment path is blank: "${assignment.path}"`);
+    }
+  }
+  return { assignments: parsed.data.assignments };
+}
+function tryResolveAgentWorkflowBridge(container) {
+  try {
+    return container.resolve("agentWorkflowBridge");
+  } catch {
+    return void 0;
+  }
+}
+async function executeInvokeAgent(config, context, container) {
+  const parsed = invokeAgentConfigSchema.safeParse(config);
+  if (!parsed.success) {
+    const issues = parsed.error.issues.map((issue) => `${issue.path.join(".") || "config"}: ${issue.message}`).join("; ");
+    throw new Error(`INVOKE_AGENT config invalid: ${issues}`);
+  }
+  const { agentId, input, onResult, outputMapping, subject, review } = parsed.data;
+  const dispositionReview = toAgentDispositionReview(resolveAgentReview(review, (value) => value));
+  const bridge = tryResolveAgentWorkflowBridge(container);
+  if (!bridge) {
+    throw new Error("[internal] agent_orchestrator not installed");
+  }
+  const stepId = context.stepContext?.stepId || context.workflowInstance.currentStepId;
+  const principalEm = container.resolve("em");
+  const effectiveUserId = await resolveWorkflowPrincipalUserId(principalEm, context.workflowInstance);
+  if (!effectiveUserId) {
+    throw new Error(
+      `[INVOKE_AGENT] Refusing to execute for workflow instance ${context.workflowInstance.id}: no traceable user (instance initiatedBy or definition author) could be resolved. Agent runs must execute under the identity of the user who triggered them.`
+    );
+  }
+  if (context.branchInstanceId) {
+    const outcome = await bridge.invokeAgentForWorkflow({
+      agentId,
+      input,
+      onResult,
+      ctx: {
+        tenantId: context.workflowInstance.tenantId,
+        organizationId: context.workflowInstance.organizationId,
+        userId: effectiveUserId,
+        workflowInstanceId: context.workflowInstance.id,
+        stepId,
+        // The step-attempt row id: a retry enters the step again and mints a new
+        // one, so it names THIS attempt and no other.
+        ...context.stepInstanceId ? { invocationId: context.stepInstanceId } : {},
+        ...subject ? { subject } : {},
+        ...dispositionReview ? { review: dispositionReview } : {}
+      }
+    });
+    if (outcome.kind === "research") {
+      return { kind: "research", agentId, data: outcome.data };
+    }
+    if (outcome.kind === "artifact") {
+      return { kind: "artifact", agentId, artifacts: outcome.artifacts, summary: outcome.summary };
+    }
+    if (outcome.kind === "auto_approved" || outcome.kind === "none_proposed") {
+      return { kind: outcome.kind, agentId, proposalId: outcome.proposalId, proposalPayload: outcome.payload };
+    }
+    return {
+      kind: "user_task",
+      agentId,
+      proposalId: outcome.proposalId,
+      __park: { signalName: INVOKE_AGENT_SIGNAL_NAME }
+    };
+  }
+  if (!context.stepInstanceId) {
+    throw new Error("[internal] INVOKE_AGENT requires a step instance to park on");
+  }
+  const queue = getInvokeAgentQueue();
+  const job = {
+    kind: "invoke_agent",
+    workflowInstanceId: context.workflowInstance.id,
+    branchInstanceId: context.branchInstanceId ?? void 0,
+    stepInstanceId: context.stepInstanceId,
+    stepId,
+    signalName: INVOKE_AGENT_SIGNAL_NAME,
+    agentId,
+    input: input ?? {},
+    onResult,
+    ...outputMapping ? { outputMapping } : {},
+    ...subject ? { subject } : {},
+    ...dispositionReview ? { review: dispositionReview } : {},
+    tenantId: context.workflowInstance.tenantId,
+    organizationId: context.workflowInstance.organizationId,
+    userId: effectiveUserId
+  };
+  const jobId = await queue.enqueue(job, { delayMs: INVOKE_AGENT_ENQUEUE_DELAY_MS });
+  return {
+    kind: "pending_agent",
+    agentId,
+    jobId,
+    __park: { signalName: INVOKE_AGENT_SIGNAL_NAME }
+  };
+}
 async function executeCallApi(em, config, context, container, signal) {
-  const interpolatedConfig = interpolateVariables(config, context.workflowContext, context.workflowInstance);
+  const interpolatedConfig = interpolateActivityConfig(config, context, "CALL_API");
   const {
     endpoint,
     method = "GET",
@@ -651,24 +945,44 @@ async function resolveActiveRoleIdsForUser(em, userId, scope) {
   }, {}, scope);
   return scopedRoles.map((r) => r.id);
 }
-async function resolveCallApiRoleIds(em, instance) {
-  if (!instance.definitionId) return [];
+async function loadInstanceDefinition(em, instance) {
+  if (!instance.definitionId) return null;
   const { findOneWithDecryption } = await import("@open-mercato/shared/lib/encryption/find");
   const { WorkflowDefinition } = await import("../data/entities.js");
+  return findOneWithDecryption(
+    em,
+    WorkflowDefinition,
+    { id: instance.definitionId, tenantId: instance.tenantId },
+    {},
+    { tenantId: instance.tenantId, organizationId: instance.organizationId }
+  );
+}
+async function resolveCallApiRoleIds(em, instance) {
+  if (!instance.definitionId) return [];
   const scope = { tenantId: instance.tenantId, organizationId: instance.organizationId };
+  const definition = await loadInstanceDefinition(em, instance);
+  if (definitionDeclaresGrant(definition)) {
+    const principalUserId = await resolveWorkflowDefinitionExecutionUserId(em, definition, null);
+    return principalUserId ? resolveActiveRoleIdsForUser(em, principalUserId, scope) : [];
+  }
   const initiatorUserId = instance.metadata?.initiatedBy ?? null;
   if (initiatorUserId) {
     return resolveActiveRoleIdsForUser(em, initiatorUserId, scope);
   }
-  const definition = await findOneWithDecryption(em, WorkflowDefinition, {
-    id: instance.definitionId,
-    tenantId: instance.tenantId,
-    deletedAt: null
-  }, {}, scope);
-  const authorUserId = definition?.createdBy;
+  const authorUserId = definition?.deletedAt ? null : definition?.createdBy;
   if (!authorUserId) return [];
   return resolveActiveRoleIdsForUser(em, authorUserId, scope);
 }
+async function resolveWorkflowPrincipalUserId(em, instance) {
+  const definition = await loadInstanceDefinition(em, instance);
+  if (definitionDeclaresGrant(definition)) {
+    return resolveWorkflowDefinitionExecutionUserId(em, definition, null);
+  }
+  const initiatorUserId = instance.metadata?.initiatedBy ?? null;
+  if (initiatorUserId) return initiatorUserId;
+  if (definition?.deletedAt) return null;
+  return definition?.createdBy ?? null;
+}
 function buildApiUrl(endpoint) {
   const appUrl = process.env.APP_URL || "http://localhost:3000";
   if (endpoint.startsWith("/")) {
@@ -709,87 +1023,117 @@ function classifyAndThrowError(status, body, url) {
   }
   throw new Error(`CALL_API request failed with status ${status}: ${bodyStr}`);
 }
-function interpolateVariables(config, context, workflowInstance) {
+function resolveInterpolationBaseValue(path, context, workflowInstance) {
+  if (path.startsWith("workflow.") && workflowInstance) {
+    const workflowKey = path.substring("workflow.".length);
+    switch (workflowKey) {
+      case "instanceId":
+        return { status: "resolved", value: workflowInstance.id };
+      case "tenantId":
+        return { status: "resolved", value: workflowInstance.tenantId };
+      case "organizationId":
+        return { status: "resolved", value: workflowInstance.organizationId };
+      case "currentStepId":
+        return { status: "resolved", value: workflowInstance.currentStepId };
+      case "workflowId":
+        return { status: "resolved", value: workflowInstance.workflowId };
+      case "version":
+        return { status: "resolved", value: workflowInstance.version };
+      default:
+        return { status: "unknown-workflow-key", workflowKey };
+    }
+  }
+  if (path.startsWith("env.")) {
+    const envKey = path.substring("env.".length);
+    if (!getWorkflowEnvInterpolationAllowlist().has(envKey)) {
+      return { status: "env-not-allowlisted", envKey };
+    }
+    return { status: "resolved", value: process.env[envKey] ?? "" };
+  }
+  if (path === "now") {
+    return { status: "resolved", value: (/* @__PURE__ */ new Date()).toISOString() };
+  }
+  const contextPath = path.startsWith("context.") ? path.substring("context.".length) : path;
+  const value = getNestedValue(context, contextPath);
+  if (value !== void 0) return { status: "resolved", value };
+  return { status: "unresolved-context", contextPath };
+}
+function strictInterpolationError(rawToken, reason) {
+  return new WorkflowInterpolationError(
+    `Cannot interpolate {{${rawToken}}}: ${reason}`,
+    rawToken
+  );
+}
+function interpolateToken(rawToken, context, workflowInstance, strict) {
+  const parsedToken = parseInterpolationToken(rawToken);
+  if (!parsedToken.ok) {
+    if (strict) throw strictInterpolationError(rawToken, parsedToken.error);
+    return { resolved: false };
+  }
+  const resolution = resolveInterpolationBaseValue(parsedToken.path, context, workflowInstance);
+  if (resolution.status === "unknown-workflow-key") {
+    if (strict) throw strictInterpolationError(rawToken, `unknown workflow key "${resolution.workflowKey}"`);
+    return { resolved: false };
+  }
+  if (resolution.status === "env-not-allowlisted") {
+    if (strict) throw strictInterpolationError(rawToken, `env variable "${resolution.envKey}" is not allowlisted`);
+  }
+  const baseValue = resolution.status === "resolved" ? resolution.value : resolution.status === "env-not-allowlisted" ? "" : void 0;
+  if (parsedToken.transforms.length === 0) {
+    if (resolution.status === "unresolved-context") {
+      if (strict) throw strictInterpolationError(rawToken, `context path "${resolution.contextPath}" is not defined`);
+      return { resolved: false };
+    }
+    return { resolved: true, value: baseValue };
+  }
+  const transformed = applyTransforms(baseValue, parsedToken.transforms);
+  if (!transformed.ok) {
+    if (strict) throw strictInterpolationError(rawToken, transformed.error.message);
+    return { resolved: false };
+  }
+  if (transformed.value === void 0) {
+    if (strict) throw strictInterpolationError(rawToken, "the transform pipeline produced no value");
+    return { resolved: false };
+  }
+  return { resolved: true, value: transformed.value };
+}
+function interpolateVariables(config, context, workflowInstance, options) {
+  const strict = options?.mode === "strict";
   if (typeof config === "string") {
     const singleVarMatch = config.match(/^\{\{([^}]+)\}\}$/);
     if (singleVarMatch) {
-      const trimmedPath = singleVarMatch[1].trim();
-      if (trimmedPath.startsWith("workflow.") && workflowInstance) {
-        const workflowKey = trimmedPath.substring("workflow.".length);
-        switch (workflowKey) {
-          case "instanceId":
-            return workflowInstance.id;
-          case "tenantId":
-            return workflowInstance.tenantId;
-          case "organizationId":
-            return workflowInstance.organizationId;
-          case "currentStepId":
-            return workflowInstance.currentStepId;
-          case "workflowId":
-            return workflowInstance.workflowId;
-          case "version":
-            return workflowInstance.version;
-          // Return as number
-          default:
-            return config;
-        }
-      }
-      if (trimmedPath.startsWith("env.")) {
-        const envKey = trimmedPath.substring("env.".length);
-        return resolveWorkflowEnvInterpolation(envKey);
-      }
-      if (trimmedPath === "now") {
-        return (/* @__PURE__ */ new Date()).toISOString();
-      }
-      const contextPath = trimmedPath.startsWith("context.") ? trimmedPath.substring("context.".length) : trimmedPath;
-      const value = getNestedValue(context, contextPath);
-      return value !== void 0 ? value : config;
+      const outcome = interpolateToken(singleVarMatch[1], context, workflowInstance, strict);
+      return outcome.resolved ? outcome.value : config;
     }
-    return config.replace(/\{\{([^}]+)\}\}/g, (match, path) => {
-      const trimmedPath = path.trim();
-      if (trimmedPath.startsWith("workflow.") && workflowInstance) {
-        const workflowKey = trimmedPath.substring("workflow.".length);
-        switch (workflowKey) {
-          case "instanceId":
-            return workflowInstance.id;
-          case "tenantId":
-            return workflowInstance.tenantId;
-          case "organizationId":
-            return workflowInstance.organizationId;
-          case "currentStepId":
-            return workflowInstance.currentStepId;
-          case "workflowId":
-            return workflowInstance.workflowId;
-          case "version":
-            return String(workflowInstance.version);
-          default:
-            return match;
-        }
-      }
-      if (trimmedPath.startsWith("env.")) {
-        const envKey = trimmedPath.substring("env.".length);
-        return resolveWorkflowEnvInterpolation(envKey);
-      }
-      if (trimmedPath === "now") {
-        return (/* @__PURE__ */ new Date()).toISOString();
-      }
-      const contextPath = trimmedPath.startsWith("context.") ? trimmedPath.substring("context.".length) : trimmedPath;
-      const value = getNestedValue(context, contextPath);
-      return value !== void 0 ? String(value) : match;
+    return config.replace(/\{\{([^}]+)\}\}/g, (match, token) => {
+      const outcome = interpolateToken(token, context, workflowInstance, strict);
+      return outcome.resolved ? String(outcome.value) : match;
     });
   }
   if (Array.isArray(config)) {
-    return config.map((item) => interpolateVariables(item, context, workflowInstance));
+    return config.map((item) => interpolateVariables(item, context, workflowInstance, options));
   }
   if (config && typeof config === "object") {
     const result = {};
     for (const [key, value] of Object.entries(config)) {
-      result[key] = interpolateVariables(value, context, workflowInstance);
+      result[key] = interpolateVariables(value, context, workflowInstance, options);
     }
     return result;
   }
   return config;
 }
+function interpolateActivityConfig(config, context, activityType, activityName) {
+  try {
+    return interpolateVariables(config, context.workflowContext, context.workflowInstance, {
+      mode: context.interpolationMode
+    });
+  } catch (error) {
+    if (error instanceof WorkflowInterpolationError) {
+      throw new ActivityExecutionError(error.message, activityType, activityName, { token: error.token });
+    }
+    throw error;
+  }
+}
 function getNestedValue(obj, path) {
   const parts = path.split(".");
   let value = obj;
@@ -824,9 +1168,26 @@ async function executeWithTimeout(executor, timeoutMs) {
     clearTimeout(timeoutId);
   }
 }
+bindActivityExecutor({
+  executeSendEmail,
+  executeEmitEvent,
+  executeUpdateEntity,
+  executeCallWebhook,
+  executeFunction,
+  executeCallApi,
+  executeSetVariable,
+  executeInvokeAgent
+});
 export {
   ActivityExecutionError,
+  INVOKE_AGENT_ENQUEUE_DELAY_MS,
+  INVOKE_AGENT_SIGNAL_NAME,
+  SUB_WORKFLOW_SIGNAL_NAME,
+  WorkflowInterpolationError,
+  calculateWaitDelayMs2 as calculateWaitDelayMs,
   enqueueActivity,
+  enqueueConditionCheckJob,
+  enqueueTaskSlaJob,
   enqueueTimerJob,
   executeActivities,
   executeActivity,
@@ -834,10 +1195,17 @@ export {
   executeCallWebhook,
   executeEmitEvent,
   executeFunction,
+  executeInvokeAgent,
   executeSendEmail,
+  executeSetVariable,
   executeUpdateEntity,
+  executeWait,
+  getActivityParkMarker,
+  interpolateVariables,
   isPrivateUrl,
   resolveActivityTimeoutMs,
-  resolveCallApiRoleIds
+  resolveCallApiRoleIds,
+  resolveDefinitionInterpolationMode,
+  resolveWorkflowPrincipalUserId
 };
 //# sourceMappingURL=activity-executor.js.map