@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/workflows/lib/activity-executor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/workflows/lib/activity-executor.ts"],
-  "sourcesContent": ["/**\n * Workflows Module - Activity Executor Service\n *\n * Executes workflow activities (send email, call API, emit events, etc.)\n * - Supports multiple activity types\n * - Implements retry logic with exponential backoff\n * - Handles timeouts\n * - Variable interpolation from workflow context\n *\n * Functional API (no classes) following Open Mercato conventions.\n */\n\nimport { EntityManager } from '@mikro-orm/core'\nimport type { EntityManager as PostgreSqlEntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { WorkflowInstance } from '../data/entities'\nimport { createModuleQueue, Queue } from '@open-mercato/queue'\nimport { getRedisUrl } from '@open-mercato/shared/lib/redis/connection'\nimport {\n  safeOutboundFetch,\n  UnsafeOutboundUrlError,\n  type HostLookup,\n} from '@open-mercato/shared/lib/url-safety'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { isPrivateCrossProcessBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport { hasAllFeatures } from '@open-mercato/shared/security/features'\nimport {\n  definitionDeclaresGrant,\n  resolveWorkflowDefinitionExecutionUserId,\n} from './definition-grant'\nimport {\n  callWebhookConfigSchema,\n  invokeAgentConfigSchema,\n  setVariableConfigSchema,\n} from '../data/activity-config-schemas'\nimport {\n  buildSetVariableContextPatch,\n  isSetVariableOutput,\n  splitAssignmentPath,\n  type SetVariableOutput,\n} from './set-variable'\nimport {\n  DRY_RUN_EVENT_TYPES,\n  WorkflowDryRunRefusalError,\n  isDryRunInstance,\n  isDryRunRefusal,\n} from './dry-run'\nimport {\n  applyTransforms,\n  parseInterpolationToken,\n  type WorkflowInterpolationMode,\n} from './interpolation-pipeline'\n\nexport { resolveDefinitionInterpolationMode, type WorkflowInterpolationMode } from './interpolation-pipeline'\nimport {\n  WorkflowActivityJob,\n  WorkflowActivityJobInvokeAgent,\n  WORKFLOW_ACTIVITIES_QUEUE_NAME,\n  WORKFLOW_INVOKE_AGENT_QUEUE_NAME,\n} from './activity-queue-types'\nimport './activity-registry-bootstrap'\nimport { bindActivityExecutor } from './activity-types'\nimport { getActivityType } from './activity-registry'\nimport { logWorkflowEvent } from './event-logger'\nimport { calculateWaitDelayMs, parseDuration } from './duration'\n\nexport { calculateWaitDelayMs } from './duration'\nimport { resolveActivityTimeoutMs } from './activityTimeoutFields'\nimport { getWorkflowSafeCommand } from './workflow-safe-commands'\nimport { isWorkflowCommandEnabled } from './workflow-command-enablement'\nimport { resolveWorkflowCommandPolicyForContainer } from './workflow-command-settings'\nimport { resolveAgentReview, toAgentDispositionReview } from './agent-review'\nimport type { AgentDispositionReview } from './agent-disposition-task'\n\nexport { isPrivateUrl } from '@open-mercato/shared/lib/network'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nfunction isAllowPrivateWorkflowWebhookUrlsEnabled(): boolean {\n  if (parseBooleanWithDefault(process.env.OM_WORKFLOWS_ALLOW_PRIVATE_URLS, false)) {\n    if (process.env.NODE_ENV === 'production') {\n      logger.warn('OM_WORKFLOWS_ALLOW_PRIVATE_URLS is set but ignored in production. SSRF protection remains enabled.', { component: 'CALL_WEBHOOK' })\n      return false\n    }\n\n    logger.warn('OM_WORKFLOWS_ALLOW_PRIVATE_URLS is enabled. SSRF protection is bypassed for workflow webhooks; use only in development.', { component: 'CALL_WEBHOOK' })\n    return true\n  }\n\n  if (parseBooleanWithDefault(process.env.WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS, false)) {\n    if (process.env.NODE_ENV === 'production') {\n      logger.warn('WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS is deprecated and ignored in production. Use OM_WORKFLOWS_ALLOW_PRIVATE_URLS for development only. SSRF protection remains enabled.', { component: 'CALL_WEBHOOK' })\n      return false\n    }\n\n    logger.warn('WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS is deprecated. Use OM_WORKFLOWS_ALLOW_PRIVATE_URLS instead. SSRF protection is bypassed.', { component: 'CALL_WEBHOOK' })\n    return true\n  }\n\n  return false\n}\n\nconst DEFAULT_WORKFLOW_ENV_INTERPOLATION_ALLOWLIST = new Set(['APP_URL'])\nconst WORKFLOW_ENV_INTERPOLATION_ALLOWLIST_KEY = 'OM_WORKFLOWS_ENV_INTERPOLATION_ALLOWLIST'\n\nfunction getWorkflowEnvInterpolationAllowlist(): Set<string> {\n  const allowlist = new Set(DEFAULT_WORKFLOW_ENV_INTERPOLATION_ALLOWLIST)\n  const configuredKeys = process.env[WORKFLOW_ENV_INTERPOLATION_ALLOWLIST_KEY]\n  if (!configuredKeys) {\n    return allowlist\n  }\n\n  for (const key of configuredKeys.split(',')) {\n    const trimmedKey = key.trim()\n    if (trimmedKey) {\n      allowlist.add(trimmedKey)\n    }\n  }\n\n  return allowlist\n}\n\n// ============================================================================\n// Types and Interfaces\n// ============================================================================\n\nexport type ActivityType =\n  | 'SEND_EMAIL'\n  | 'CALL_API'\n  | 'EMIT_EVENT'\n  | 'UPDATE_ENTITY'\n  | 'CALL_WEBHOOK'\n  | 'EXECUTE_FUNCTION'\n  | 'WAIT'\n  | 'SET_VARIABLE'\n  | 'INVOKE_AGENT'\n\n/**\n * Signal name the INVOKE_AGENT step parks on when a proposal is routed to a\n * human. agent_orchestrator's proposal-dispose path emits\n * `agent_orchestrator.proposal.ready` and calls workflows `sendSignal` with this\n * name to resume the parked step.\n */\nexport const INVOKE_AGENT_SIGNAL_NAME = 'agent_orchestrator.proposal.ready'\n\n/**\n * Signal name a parked SUB_WORKFLOW step resumes on once its child instance\n * reaches a terminal state. `completeWorkflow` enqueues a resume job when the\n * child carries a parent linkage; the worker resumes the parent step via\n * `sendSignal` with this name.\n */\nexport const SUB_WORKFLOW_SIGNAL_NAME = 'workflows.sub_workflow.completed'\n\n/**\n * Small enqueue delay for the INVOKE_AGENT job so the workflow transaction that\n * parked the step commits before the worker picks the job up. The worker also\n * guards against the race (it requires the instance to be PAUSED at the step\n * before running the agent), so this only trims needless retries.\n */\nexport const INVOKE_AGENT_ENQUEUE_DELAY_MS = 1000\n\n/**\n * Marker carried on an activity result's output when the step must park and wait\n * for a signal (INVOKE_AGENT routed a proposal to a human). The step handler\n * inspects activity outputs for this marker and parks the instance accordingly.\n * researcher / auto_approved outcomes do NOT carry it and proceed inline.\n */\nexport type ActivityParkMarker = { signalName: string }\n\nexport function getActivityParkMarker(output: unknown): ActivityParkMarker | null {\n  if (output && typeof output === 'object' && '__park' in output) {\n    const park = (output as { __park?: unknown }).__park\n    if (park && typeof park === 'object' && typeof (park as { signalName?: unknown }).signalName === 'string') {\n      return { signalName: (park as { signalName: string }).signalName }\n    }\n  }\n  return null\n}\n\nexport interface ActivityDefinition {\n  activityId: string // Unique identifier for activity\n  activityName?: string // Optional, for debugging/logging\n  activityType: ActivityType\n  config: any\n  async?: boolean // Flag to execute activity asynchronously via queue\n  retryPolicy?: RetryPolicy\n  timeoutMs?: number\n  /**\n   * @deprecated Use `timeoutMs`. Legacy ISO 8601 duration string accepted by\n   * the definition schema before #4424; normalized by `resolveActivityTimeoutMs`.\n   */\n  timeout?: string\n  compensate?: boolean // Flag to execute compensation on failure\n}\n\nexport { resolveActivityTimeoutMs }\n\nexport interface RetryPolicy {\n  maxAttempts: number\n  initialIntervalMs: number\n  backoffCoefficient: number\n  maxIntervalMs: number\n}\n\nexport interface ActivityContext {\n  workflowInstance: WorkflowInstance\n  workflowContext: Record<string, any>\n  stepContext?: Record<string, any>\n  stepInstanceId?: string\n  // Set when the activity runs inside a parallel branch; carried on the queue\n  // payload so async resume targets the branch rather than the instance.\n  branchInstanceId?: string | null\n  transitionId?: string\n  userId?: string\n  // The owning definition's `interpolation` mode; absent means lenient.\n  // Async activities enforce strict mode at enqueue-time, so the worker-side\n  // context deliberately leaves this unset.\n  interpolationMode?: WorkflowInterpolationMode\n}\n\ntype RbacFeatureResolver = {\n  userHasAllFeatures: (\n    userId: string,\n    required: string[],\n    opts: { tenantId: string | null; organizationId: string | null }\n  ) => Promise<boolean>\n}\n\nasync function workflowUserHasAllFeatures(\n  container: AwilixContainer,\n  userId: string,\n  required: readonly string[],\n  tenantId: string | null,\n  organizationId: string | null\n): Promise<boolean> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacFeatureResolver | undefined\n    if (rbac?.userHasAllFeatures) {\n      return await rbac.userHasAllFeatures(userId, [...required], { tenantId, organizationId })\n    }\n  } catch {\n    // Fail closed below when the workflow executor cannot prove the actor's grants.\n  }\n  return false\n}\n\nexport interface ActivityExecutionResult {\n  activityId: string\n  activityName?: string\n  activityType: ActivityType\n  success: boolean\n  output?: any\n  error?: string\n  retryCount: number\n  executionTimeMs: number\n  async?: boolean // Marks activity as async (queued)\n  jobId?: string // Queue job ID for async activities\n  /**\n   * The activity was not attempted because a dry run cannot simulate its type\n   * (spec section 8.2). Callers MUST treat it as a stop, never as a failure:\n   * error routes and error directives describe what to do when an effector\n   * fails, and no effector ran.\n   */\n  dryRunRefused?: boolean\n}\n\nexport class ActivityExecutionError extends Error {\n  constructor(\n    message: string,\n    public activityType: ActivityType,\n    public activityName?: string,\n    public details?: any\n  ) {\n    super(message)\n    this.name = 'ActivityExecutionError'\n  }\n}\n\n/**\n * Thrown by `interpolateVariables` in strict mode when a token cannot be\n * resolved (unresolved context path, env-allowlist miss, unknown workflow.*\n * key, failed or unparseable transform pipeline). Activity call sites rethrow\n * it as `ActivityExecutionError` so it flows through the normal retry/failure\n * machinery.\n */\nexport class WorkflowInterpolationError extends Error {\n  constructor(\n    message: string,\n    public token: string\n  ) {\n    super(message)\n    this.name = 'WorkflowInterpolationError'\n  }\n}\n\n// ============================================================================\n// Queue Integration for Async Activities\n// ============================================================================\n\nlet activityQueue: Queue<WorkflowActivityJob> | null = null\nlet invokeAgentQueue: Queue<WorkflowActivityJob> | null = null\n\n/**\n * Get or create the activity queue (lazy initialization)\n */\nfunction getActivityQueue(): Queue<WorkflowActivityJob> {\n  if (!activityQueue) {\n    activityQueue = createModuleQueue<WorkflowActivityJob>(\n      WORKFLOW_ACTIVITIES_QUEUE_NAME,\n      { concurrency: parseInt(process.env.WORKFLOW_WORKER_CONCURRENCY || '5') },\n    )\n  }\n\n  return activityQueue\n}\n\n/**\n * Get or create the dedicated invoke-agent queue (lazy initialization).\n *\n * Minute-long agent runs get their own queue so they never starve the fast\n * activities sharing 'workflow-activities'. Consumer-side concurrency is\n * governed by the workflow-invoke-agent worker's metadata.\n */\nfunction getInvokeAgentQueue(): Queue<WorkflowActivityJob> {\n  if (!invokeAgentQueue) {\n    invokeAgentQueue = createModuleQueue<WorkflowActivityJob>(\n      WORKFLOW_INVOKE_AGENT_QUEUE_NAME,\n      { concurrency: parseInt(process.env.WORKERS_WORKFLOW_INVOKE_AGENT_CONCURRENCY || '5', 10) },\n    )\n  }\n\n  return invokeAgentQueue\n}\n\n/**\n * Enqueue an activity for background execution\n *\n * @param em - Entity manager\n * @param activity - Activity definition\n * @param context - Execution context\n * @returns Job ID\n */\nexport async function enqueueActivity(\n  em: EntityManager,\n  activity: ActivityDefinition,\n  context: ActivityContext\n): Promise<string> {\n  const { workflowInstance, workflowContext, stepContext, transitionId, stepInstanceId, branchInstanceId } =\n    context\n\n  const registryEntry = getActivityType(activity.activityType)\n  if (registryEntry && registryEntry.async.capable === false) {\n    throw new ActivityExecutionError(\n      `[internal] Activity type ${activity.activityType} cannot run asynchronously (${registryEntry.async.reason})`,\n      activity.activityType,\n      activity.activityName\n    )\n  }\n\n  // Interpolate config variables NOW (before queuing) \u2014 strict mode is\n  // enforced here, at enqueue-time, before the job serializes frozen config.\n  const interpolatedConfig = interpolateActivityConfig(\n    activity.config,\n    context,\n    activity.activityType,\n    activity.activityName\n  )\n\n  // Create job payload\n  const job: WorkflowActivityJob = {\n    workflowInstanceId: workflowInstance.id,\n    stepInstanceId,\n    branchInstanceId: branchInstanceId ?? undefined,\n    transitionId,\n    activityId: activity.activityId,\n    activityName: activity.activityName || activity.activityType,\n    activityType: activity.activityType,\n    activityConfig: interpolatedConfig,\n    workflowContext,\n    stepContext,\n    retryPolicy: activity.retryPolicy,\n    timeoutMs: activity.timeoutMs,\n    tenantId: workflowInstance.tenantId,\n    organizationId: workflowInstance.organizationId,\n    userId: context.userId,\n  }\n\n  // Enqueue to queue (entries with enqueueDelayMs, e.g. WAIT, use delayMs for the actual delay)\n  const queue = getActivityQueue()\n  const registryDelayMs = registryEntry?.enqueueDelayMs\n    ? registryEntry.enqueueDelayMs(interpolatedConfig)\n    : null\n  const enqueueOptions = registryDelayMs !== null ? { delayMs: registryDelayMs } : undefined\n  const jobId = await queue.enqueue(job, enqueueOptions)\n\n  // Log event\n  await logWorkflowEvent(em, {\n    workflowInstanceId: workflowInstance.id,\n    stepInstanceId,\n    eventType: 'ACTIVITY_QUEUED',\n    eventData: {\n      activityId: activity.activityId,\n      activityName: activity.activityName,\n      activityType: activity.activityType,\n      async: true,\n      jobId,\n    },\n    tenantId: workflowInstance.tenantId,\n    organizationId: workflowInstance.organizationId,\n  })\n\n  return jobId\n}\n\n/**\n * Enqueue a delayed timer job for a WAIT_FOR_TIMER step.\n *\n * The activity worker handles `kind: 'timer'` jobs by calling\n * `timerHandler.fireTimer`, which resumes the paused workflow instance.\n */\nexport async function enqueueTimerJob(params: {\n  workflowInstanceId: string\n  stepInstanceId: string\n  branchInstanceId?: string | null\n  tenantId: string\n  organizationId: string\n  userId?: string\n  fireAt: string\n  delayMs: number\n}): Promise<string> {\n  const { workflowInstanceId, stepInstanceId, branchInstanceId, tenantId, organizationId, userId, fireAt, delayMs } =\n    params\n\n  const queue = getActivityQueue()\n  const jobId = await queue.enqueue(\n    {\n      kind: 'timer',\n      workflowInstanceId,\n      stepInstanceId,\n      branchInstanceId: branchInstanceId ?? undefined,\n      tenantId,\n      organizationId,\n      userId,\n      fireAt,\n    },\n    { delayMs: delayMs > 0 ? delayMs : undefined }\n  )\n\n  return jobId\n}\n\n/**\n * Enqueue a delayed SLA job for a USER_TASK (one reminder offset, or the\n * deadline itself).\n *\n * The activity worker handles `kind: 'task_sla'` jobs by calling\n * `taskSla.runTaskSlaJob`. `deadlineAt` is absolute and carried on the payload\n * rather than recomputed at run time, so a queue running behind can never\n * extend the configured deadline \u2014 the same guarantee the WAIT_FOR_CONDITION\n * backstop gives.\n */\nexport async function enqueueTaskSlaJob(params: {\n  workflowInstanceId: string\n  stepInstanceId: string\n  branchInstanceId?: string | null\n  userTaskId: string\n  phase: 'reminder' | 'breach'\n  deadlineAt: string\n  fireAt: string\n  delayMs: number\n  tenantId: string\n  organizationId: string\n  userId?: string\n}): Promise<string> {\n  const {\n    workflowInstanceId,\n    stepInstanceId,\n    branchInstanceId,\n    userTaskId,\n    phase,\n    deadlineAt,\n    fireAt,\n    delayMs,\n    tenantId,\n    organizationId,\n    userId,\n  } = params\n\n  const queue = getActivityQueue()\n  return await queue.enqueue(\n    {\n      kind: 'task_sla',\n      workflowInstanceId,\n      stepInstanceId,\n      branchInstanceId: branchInstanceId ?? undefined,\n      userTaskId,\n      phase,\n      deadlineAt,\n      fireAt,\n      tenantId,\n      organizationId,\n      userId,\n    },\n    { delayMs: delayMs > 0 ? delayMs : undefined }\n  )\n}\n\n/**\n * Enqueue a delayed poll job for a WAIT_FOR_CONDITION step.\n *\n * The activity worker handles `kind: 'condition'` jobs by calling\n * `conditionHandler.evaluateWaitCondition`. This job is the durability\n * backstop behind the event-driven wake: `deadlineAt` travels unchanged across\n * every re-enqueue so the timeout stays anchored to the original step entry.\n */\nexport async function enqueueConditionCheckJob(params: {\n  workflowInstanceId: string\n  stepInstanceId: string\n  branchInstanceId?: string | null\n  tenantId: string\n  organizationId: string\n  userId?: string\n  deadlineAt: string\n  attempt: number\n  delayMs: number\n}): Promise<string> {\n  const {\n    workflowInstanceId,\n    stepInstanceId,\n    branchInstanceId,\n    tenantId,\n    organizationId,\n    userId,\n    deadlineAt,\n    attempt,\n    delayMs,\n  } = params\n\n  const queue = getActivityQueue()\n  const jobId = await queue.enqueue(\n    {\n      kind: 'condition',\n      workflowInstanceId,\n      stepInstanceId,\n      branchInstanceId: branchInstanceId ?? undefined,\n      tenantId,\n      organizationId,\n      userId,\n      deadlineAt,\n      attempt,\n    },\n    { delayMs: delayMs > 0 ? delayMs : undefined }\n  )\n\n  return jobId\n}\n\n// ============================================================================\n// Main Activity Execution Functions\n// ============================================================================\n\n/**\n * Execute a single activity with retry logic and timeout\n *\n * @param em - Entity manager\n * @param container - DI container\n * @param activity - Activity definition\n * @param context - Execution context\n * @returns Execution result\n */\nexport async function executeActivity(\n  em: EntityManager,\n  container: AwilixContainer,\n  activity: ActivityDefinition,\n  context: ActivityContext\n): Promise<ActivityExecutionResult> {\n  const retryPolicy = activity.retryPolicy || {\n    maxAttempts: 1,\n    initialIntervalMs: 0,\n    backoffCoefficient: 1,\n    maxIntervalMs: 0,\n  }\n\n  let lastError: any\n  let retryCount = 0\n\n  for (let attempt = 0; attempt < retryPolicy.maxAttempts; attempt++) {\n    try {\n      const startTime = Date.now()\n\n      // Execute with timeout if specified (timeoutMs, or a legacy ISO 8601\n      // `timeout` string normalized to ms \u2014 see resolveActivityTimeoutMs).\n      const timeoutMs = resolveActivityTimeoutMs(activity)\n      const result = timeoutMs\n        ? await executeWithTimeout(\n            (signal) => executeActivityByType(em, container, activity, context, signal),\n            timeoutMs\n          )\n        : await executeActivityByType(em, container, activity, context)\n\n      const executionTimeMs = Date.now() - startTime\n\n      return {\n        activityId: activity.activityId,\n        activityName: activity.activityName,\n        activityType: activity.activityType,\n        success: true,\n        output: result,\n        retryCount: attempt,\n        executionTimeMs,\n        async: activity.async || false,\n      }\n    } catch (error) {\n      lastError = error\n      retryCount = attempt + 1\n\n      // A dry-run refusal is not a failure \u2014 nothing was attempted \u2014 so retrying\n      // it would only re-log the same refusal N times before reaching the same\n      // answer.\n      if (isDryRunRefusal(error)) break\n\n      // Log activity retry attempt with context\n      if (attempt < retryPolicy.maxAttempts - 1) {\n        logger.error('Activity failed; will retry', {\n          activityId: activity.activityId,\n          activityType: activity.activityType,\n          attempt: attempt + 1,\n          maxAttempts: retryPolicy.maxAttempts,\n          instanceId: context.workflowInstance.id,\n          err: error,\n        })\n      }\n\n      // If not the last attempt, apply backoff and retry\n      if (attempt < retryPolicy.maxAttempts - 1) {\n        const backoff = calculateBackoff(\n          retryPolicy.initialIntervalMs,\n          retryPolicy.backoffCoefficient,\n          attempt,\n          retryPolicy.maxIntervalMs\n        )\n\n        await sleep(backoff)\n      }\n    }\n  }\n\n  // All retries exhausted\n  const errorMessage = lastError instanceof Error ? lastError.message : String(lastError)\n  if (isDryRunRefusal(lastError)) {\n    return {\n      activityId: activity.activityId,\n      activityName: activity.activityName,\n      activityType: activity.activityType,\n      success: false,\n      dryRunRefused: true,\n      error: `Dry run stopped: activity type ${lastError.activityType} cannot be simulated (${lastError.reason})`,\n      retryCount: 0,\n      executionTimeMs: 0,\n      async: activity.async || false,\n    }\n  }\n  logger.error('Activity failed after all attempts', {\n    activityId: activity.activityId,\n    activityType: activity.activityType,\n    attempts: retryCount,\n    instanceId: context.workflowInstance.id,\n    err: lastError,\n  })\n\n  return {\n    activityId: activity.activityId,\n    activityName: activity.activityName,\n    activityType: activity.activityType,\n    success: false,\n    error: `Activity failed after ${retryCount} attempts: ${errorMessage}`,\n    retryCount,\n    executionTimeMs: 0,\n    async: activity.async || false,\n  }\n}\n\n/**\n * Execute multiple activities in sequence\n * Supports both synchronous and asynchronous (queued) execution\n *\n * @param em - Entity manager\n * @param container - DI container\n * @param activities - Array of activity definitions\n * @param context - Execution context\n * @returns Array of execution results\n */\nexport async function executeActivities(\n  em: EntityManager,\n  container: AwilixContainer,\n  activities: ActivityDefinition[],\n  context: ActivityContext\n): Promise<ActivityExecutionResult[]> {\n  const results: ActivityExecutionResult[] = []\n\n  // A dry run never enqueues. The queue job would carry no `isDryRun` of its\n  // own, so a worker picking it up would execute the real effector on its own\n  // connection \u2014 the isolation would leak out of the request that opted in.\n  // Mocks are pure and synchronous, so running them inline loses nothing.\n  const forceSynchronous = isDryRunInstance(context.workflowInstance)\n\n  for (let i = 0; i < activities.length; i++) {\n    const activity = activities[i]\n\n    // Check if activity should run async\n    if (activity.async && !forceSynchronous) {\n      // Enqueue for background execution\n      const jobId = await enqueueActivity(em, activity, context)\n\n      results.push({\n        activityId: activity.activityId,\n        activityName: activity.activityName,\n        activityType: activity.activityType,\n        success: true, // Queued successfully\n        async: true,\n        jobId,\n        retryCount: 0,\n        executionTimeMs: 0,\n      })\n    } else {\n      // Execute synchronously (existing logic)\n      const executed = await executeActivity(em, container, activity, context)\n      // `executeActivity` echoes the AUTHORED `async` flag, which is what the\n      // transition handler reads to decide whether to park the token in\n      // WAITING_FOR_ACTIVITIES. A dry run that ran an authored-async activity\n      // inline must therefore correct the flag, or the run would park waiting\n      // for a queue job that was deliberately never enqueued \u2014 a deadlock, and\n      // the step handler would also misclassify a refusal as \"still pending\"\n      // instead of a failure.\n      const result = forceSynchronous && activity.async\n        ? { ...executed, async: false }\n        : executed\n      results.push(result)\n\n      // Stop execution if activity fails (fail-fast)\n      if (!result.success) {\n        break\n      }\n\n      // Update workflow context with activity output. SET_VARIABLE outputs\n      // land at their assignment paths in top-level context; every other\n      // output merges under the activity name/type key.\n      if (result.output && typeof result.output === 'object') {\n        if (activity.activityType === 'SET_VARIABLE' && isSetVariableOutput(result.output)) {\n          context.workflowContext = {\n            ...context.workflowContext,\n            ...buildSetVariableContextPatch(context.workflowContext, result.output.assignments),\n          }\n        } else {\n          const key = activity.activityName || activity.activityType\n          context.workflowContext = {\n            ...context.workflowContext,\n            [key]: result.output,\n          }\n        }\n      }\n    }\n  }\n\n  return results\n}\n\n// ============================================================================\n// Activity Type Handlers\n// ============================================================================\n\n/**\n * Execute activity based on its type\n */\nasync function executeActivityByType(\n  em: EntityManager,\n  container: AwilixContainer,\n  activity: ActivityDefinition,\n  context: ActivityContext,\n  signal?: AbortSignal\n): Promise<any> {\n  // Interpolate config variables from context (including workflow metadata)\n  const interpolatedConfig = interpolateActivityConfig(\n    activity.config,\n    context,\n    activity.activityType,\n    activity.activityName\n  )\n\n  const entry = getActivityType(activity.activityType)\n  if (!entry) {\n    throw new ActivityExecutionError(\n      `Unknown activity type: ${activity.activityType}`,\n      activity.activityType,\n      activity.activityName\n    )\n  }\n\n  // Dry run (spec section 8.2): the ONE place `entry.execute` is reached, so it\n  // is the one place the swap has to happen. Everything side-effecting in the\n  // engine ends up here \u2014 the command bus, the event bus, the mailer, the\n  // webhook fetch and the agent bridge \u2014 which is what makes \"no effector runs\"\n  // a property of a single branch rather than a checklist.\n  if (isDryRunInstance(context.workflowInstance)) {\n    if (entry.mock === 'refuse' || entry.mock === undefined) {\n      const refusal = new WorkflowDryRunRefusalError(\n        activity.activityType,\n        entry.mock === 'refuse' ? 'refused' : 'noMock',\n        activity.activityName,\n      )\n      await logWorkflowEvent(em, {\n        workflowInstanceId: context.workflowInstance.id,\n        stepInstanceId: context.stepInstanceId,\n        eventType: DRY_RUN_EVENT_TYPES.activityRefused,\n        eventData: {\n          activityId: activity.activityId,\n          activityName: activity.activityName,\n          activityType: activity.activityType,\n          reason: refusal.reason,\n        },\n        tenantId: context.workflowInstance.tenantId,\n        organizationId: context.workflowInstance.organizationId,\n      })\n      throw refusal\n    }\n\n    const simulated = entry.mock(interpolatedConfig, context)\n    await logWorkflowEvent(em, {\n      workflowInstanceId: context.workflowInstance.id,\n      stepInstanceId: context.stepInstanceId,\n      eventType: DRY_RUN_EVENT_TYPES.activitySimulated,\n      eventData: {\n        activityId: activity.activityId,\n        activityName: activity.activityName,\n        activityType: activity.activityType,\n        output: simulated ?? null,\n      },\n      tenantId: context.workflowInstance.tenantId,\n      organizationId: context.workflowInstance.organizationId,\n    })\n    return simulated\n  }\n\n  // `signal` MUST reach the registry entry: CALL_API / CALL_WEBHOOK thread it\n  // into fetch, and without it a per-activity timeout rejects the promise while\n  // the HTTP request stays in flight \u2014 the phantom-execution bug from #4918.\n  return await entry.execute(interpolatedConfig, context, {\n    em: em as PostgreSqlEntityManager,\n    container,\n    signal,\n  })\n}\n\n/**\n * SEND_EMAIL activity handler\n *\n * Sends via the DI-registered emailService when available; without one it\n * reports an honest stub result ({ sent: false, simulated: true, reason: 'no-email-service' }).\n * A real send() failure propagates so the activity retry loop handles it.\n */\nexport async function executeSendEmail(\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer\n): Promise<any> {\n  const { to, subject, template, templateData, body } = config\n\n  if (!to || !subject) {\n    throw new Error('SEND_EMAIL requires \"to\" and \"subject\" fields')\n  }\n\n  logger.info('Send email activity invoked', { component: 'SEND_EMAIL', subject })\n\n  let emailService: { send: (input: unknown) => Promise<unknown> | unknown } | undefined\n  try {\n    emailService = container.resolve<{ send: (input: unknown) => Promise<unknown> | unknown }>('emailService')\n  } catch {\n    emailService = undefined\n  }\n\n  if (emailService && typeof emailService.send === 'function') {\n    await emailService.send({\n      to,\n      subject,\n      template,\n      templateData,\n      body,\n    })\n    return { sent: true, to, subject, via: 'emailService' }\n  }\n\n  logger.warn('SEND_EMAIL has no registered email service; email was not sent', { component: 'SEND_EMAIL', subject })\n  return { sent: false, simulated: true, to, subject, via: 'console', reason: 'no-email-service' }\n}\n\n/**\n * EMIT_EVENT activity handler\n *\n * Publishes a domain event to the event bus\n */\nexport async function executeEmitEvent(\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer\n): Promise<any> {\n  const { eventName, payload } = config\n\n  if (!eventName) {\n    throw new Error('EMIT_EVENT requires \"eventName\" field')\n  }\n\n  // Workflow definitions are tenant-managed input. Private cross-process\n  // events coordinate trusted server state (for example closing an in-memory\n  // collaboration room), so allowing a workflow to name one would turn a\n  // regular event activity into a cross-process invalidation primitive.\n  if (isPrivateCrossProcessBroadcastEvent(eventName)) {\n    throw new Error(`EMIT_EVENT cannot emit private cross-process event \"${eventName}\"`)\n  }\n\n  // Emissions are fire-and-forget and no subscriber validates the payload shape,\n  // so an unresolved `{{context.x}}` here is even quieter than on the command\n  // path \u2014 it ships the literal template to every consumer. Fail loudly instead.\n  const unresolvedPayloadKeys = findUnresolvedTemplateKeys(payload)\n  if (unresolvedPayloadKeys.length > 0) {\n    throw new Error(\n      `EMIT_EVENT payload contains unresolved template variables for: ${unresolvedPayloadKeys.join(', ')}. ` +\n        `Check that the workflow context provides these keys.`\n    )\n  }\n\n  // Get event bus from container\n  const eventBus = container.resolve<{ emitEvent: (event: string, payload: unknown, options?: unknown) => Promise<unknown> | unknown }>('eventBus')\n\n  if (!eventBus || typeof eventBus.emitEvent !== 'function') {\n    throw new Error('Event bus not available in container')\n  }\n\n  // Publish event with workflow metadata\n  const enrichedPayload = {\n    ...payload,\n    _workflow: {\n      workflowInstanceId: context.workflowInstance.id,\n      workflowId: context.workflowInstance.workflowId,\n      tenantId: context.workflowInstance.tenantId,\n      organizationId: context.workflowInstance.organizationId,\n    },\n  }\n\n  await eventBus.emitEvent(eventName, enrichedPayload, {\n    tenantId: context.workflowInstance.tenantId,\n    organizationId: context.workflowInstance.organizationId,\n  })\n\n  return { emitted: true, eventName, payload: enrichedPayload }\n}\n\nconst UNRESOLVED_TEMPLATE_PATTERN = /\\{\\{[^}]+\\}\\}/\n\nfunction findUnresolvedTemplateKeys(value: unknown, path = ''): string[] {\n  if (typeof value === 'string') {\n    return UNRESOLVED_TEMPLATE_PATTERN.test(value) ? [path] : []\n  }\n  if (Array.isArray(value)) {\n    return value.flatMap((item, index) => findUnresolvedTemplateKeys(item, `${path}[${index}]`))\n  }\n  if (value && typeof value === 'object') {\n    return Object.entries(value).flatMap(([key, nested]) =>\n      findUnresolvedTemplateKeys(nested, path ? `${path}.${key}` : key)\n    )\n  }\n  return []\n}\n\n/**\n * UPDATE_ENTITY activity handler\n *\n * Updates an entity via CommandBus for proper audit logging, undo support, and side effects.\n *\n * Config format:\n * ```json\n * {\n *   \"commandId\": \"sales.documents.update\",\n *   \"input\": {\n *     \"id\": \"{{context.orderId}}\",\n *     \"statusEntryId\": \"{{context.approvedStatusId}}\"\n *   }\n * }\n * ```\n *\n * Alternative format with statusValue (auto-resolves to statusEntryId):\n * ```json\n * {\n *   \"commandId\": \"sales.orders.update\",\n *   \"statusDictionary\": \"sales.order_status\",\n *   \"input\": {\n *     \"id\": \"{{context.orderId}}\",\n *     \"statusValue\": \"pending_approval\"\n *   }\n * }\n * ```\n *\n * Every `{{...}}` reference in `input` must resolve against the workflow context \u2014\n * an unresolved reference is rejected rather than forwarded to the command bus.\n */\nexport async function executeUpdateEntity(\n  em: EntityManager,\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer\n): Promise<any> {\n  const { commandId, input, statusDictionary } = config\n\n  if (!commandId) {\n    throw new Error('UPDATE_ENTITY requires \"commandId\" field (e.g., \"sales.documents.update\")')\n  }\n\n  // Gate 1 \u2014 the CODE declares this command possible.\n  const workflowSafeCommand = getWorkflowSafeCommand(commandId)\n  if (!workflowSafeCommand) {\n    throw new Error('UPDATE_ENTITY command is not allowed')\n  }\n\n  // Gate 2 \u2014 this TENANT switched it on. A tenant that never saved the setting\n  // resolves to the grandfathered set, so this is byte-identical to the\n  // pre-setting behaviour for every existing tenant.\n  const commandPolicy = await resolveWorkflowCommandPolicyForContainer(\n    container,\n    context.workflowInstance.tenantId,\n  )\n  if (!isWorkflowCommandEnabled(workflowSafeCommand, commandPolicy)) {\n    throw new Error('UPDATE_ENTITY command is not enabled for this tenant')\n  }\n\n  if (!input || typeof input !== 'object') {\n    throw new Error('UPDATE_ENTITY requires \"input\" object with entity data')\n  }\n\n  const actorUserId = typeof context.userId === 'string' ? context.userId.trim() : ''\n  if (!actorUserId) {\n    throw new Error('UPDATE_ENTITY requires an authenticated workflow user')\n  }\n\n  const authorized = await workflowUserHasAllFeatures(\n    container,\n    actorUserId,\n    workflowSafeCommand.requiredFeatures,\n    context.workflowInstance.tenantId,\n    context.workflowInstance.organizationId\n  )\n  if (!authorized) {\n    throw new Error('UPDATE_ENTITY command is not authorized')\n  }\n\n  // Resolve CommandBus from container\n  const commandBus = container.resolve('commandBus') as any\n\n  if (!commandBus || typeof commandBus.execute !== 'function') {\n    throw new Error('CommandBus not available in container')\n  }\n\n  const unresolvedKeys = findUnresolvedTemplateKeys(input)\n  if (unresolvedKeys.length > 0) {\n    throw new Error(\n      `UPDATE_ENTITY input contains unresolved template variables for: ${unresolvedKeys.join(', ')}. ` +\n        `Check that the workflow context provides these keys.`\n    )\n  }\n\n  // Prepare final input, resolving statusValue if provided\n  let finalInput = { ...input }\n\n  // If statusValue is provided with a statusDictionary, resolve it to statusEntryId\n  if (finalInput.statusValue && statusDictionary) {\n    const statusEntryId = await resolveDictionaryEntryId(\n      em,\n      statusDictionary,\n      finalInput.statusValue,\n      context.workflowInstance.tenantId,\n      context.workflowInstance.organizationId\n    )\n    if (statusEntryId) {\n      finalInput.statusEntryId = statusEntryId\n    }\n    delete finalInput.statusValue\n  }\n\n  // Build synthetic CommandRuntimeContext for workflow execution\n  const ctx = {\n    container,\n    auth: {\n      sub: actorUserId,\n      tenantId: context.workflowInstance.tenantId,\n      orgId: context.workflowInstance.organizationId,\n      isSuperAdmin: false,\n    },\n    organizationScope: null,\n    selectedOrganizationId: context.workflowInstance.organizationId,\n    organizationIds: context.workflowInstance.organizationId\n      ? [context.workflowInstance.organizationId]\n      : null,\n  }\n\n  // Execute the command\n  const { result, logEntry } = await commandBus.execute(commandId, {\n    input: finalInput,\n    ctx,\n  })\n\n  return {\n    executed: true,\n    commandId,\n    result,\n    logEntryId: logEntry?.id,\n  }\n}\n\n/**\n * Helper to resolve dictionary entry ID by value\n */\nasync function resolveDictionaryEntryId(\n  em: EntityManager,\n  dictionaryKey: string,\n  value: string,\n  tenantId: string,\n  organizationId: string\n): Promise<string | null> {\n  try {\n    // Import here to avoid circular dependencies\n    const { Dictionary, DictionaryEntry } = await import('@open-mercato/core/modules/dictionaries/data/entities')\n\n    // Find the dictionary\n    const dictionary = await em.findOne(Dictionary, {\n      key: dictionaryKey,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!dictionary) {\n      logger.warn('Dictionary not found', { component: 'UPDATE_ENTITY', dictionaryKey })\n      return null\n    }\n\n    // Find the entry by normalized value\n    const normalizedValue = value.toLowerCase().trim()\n    const entry = await em.findOne(DictionaryEntry, {\n      dictionary: dictionary.id,\n      tenantId,\n      organizationId,\n      normalizedValue,\n    })\n\n    if (!entry) {\n      logger.warn('Dictionary entry not found', { component: 'UPDATE_ENTITY', dictionaryKey, value })\n      return null\n    }\n\n    return entry.id\n  } catch (error) {\n    logger.error('Error resolving dictionary entry', { component: 'UPDATE_ENTITY', err: error })\n    return null\n  }\n}\n\n/**\n * CALL_WEBHOOK activity handler\n *\n * Makes HTTP request to an external URL. Applies shared SSRF guard\n * (protocol / credentials / blocked host / private IP literal / DNS rebinding)\n * before issuing the request and rejects any 3xx redirect rather than following.\n */\nexport type CallWebhookDeps = {\n  lookupHost?: HostLookup\n  allowPrivate?: boolean\n  fetchImpl?: typeof fetch\n  signal?: AbortSignal\n}\n\nexport async function executeCallWebhook(\n  config: unknown,\n  context: ActivityContext,\n  deps: CallWebhookDeps = {}\n): Promise<any> {\n  const parsed = callWebhookConfigSchema.safeParse(config)\n  if (!parsed.success) {\n    const issues = parsed.error.issues\n      .map((issue) => `${issue.path.join('.') || 'config'}: ${issue.message}`)\n      .join('; ')\n    throw new Error(`CALL_WEBHOOK config invalid: ${issues}`)\n  }\n  const { url, method, headers: rawHeaders, body } = parsed.data\n  const headers = rawHeaders ?? {}\n\n  const allowPrivate = deps.allowPrivate ?? isAllowPrivateWorkflowWebhookUrlsEnabled()\n\n  let response: Response\n  try {\n    response = await safeOutboundFetch(\n      url,\n      {\n        method,\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: body !== undefined && body !== null ? JSON.stringify(body) : undefined,\n        redirect: 'manual',\n        signal: deps.signal,\n      },\n      {\n        subject: 'Workflow webhook URL',\n        allowPrivate,\n        lookupHost: deps.lookupHost,\n        fetchImpl: deps.fetchImpl,\n      },\n    )\n  } catch (error) {\n    if (error instanceof UnsafeOutboundUrlError) {\n      throw new Error(\n        `CALL_WEBHOOK rejected unsafe URL (reason=${error.reason}): ${error.message}`\n      )\n    }\n    throw error\n  }\n\n  if (response.status >= 300 && response.status < 400) {\n    const location = response.headers.get('location')\n    throw new Error(\n      `CALL_WEBHOOK refused to follow redirect ${response.status} to ${\n        location ?? '(no Location header)'\n      }`\n    )\n  }\n\n  // Parse response\n  let result: any\n  const contentType = response.headers.get('content-type')\n\n  if (contentType && contentType.includes('application/json')) {\n    result = await response.json()\n  } else {\n    result = await response.text()\n  }\n\n  // Check for HTTP errors\n  if (!response.ok) {\n    throw new Error(\n      `Webhook request failed with status ${response.status}: ${JSON.stringify(result)}`\n    )\n  }\n\n  return {\n    status: response.status,\n    statusText: response.statusText,\n    result,\n  }\n}\n\n/**\n * EXECUTE_FUNCTION activity handler\n *\n * Calls a registered function from DI container\n */\nexport async function executeFunction(\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer\n): Promise<any> {\n  const { functionName, args = {} } = config\n\n  if (!functionName) {\n    throw new Error('EXECUTE_FUNCTION requires \"functionName\" field')\n  }\n\n  // Look up function in container\n  const fnKey = `workflowFunction:${functionName}`\n\n  try {\n    const fn = container.resolve(fnKey)\n\n    if (typeof fn !== 'function') {\n      throw new Error(`Registered workflow function \"${functionName}\" is not a function`)\n    }\n\n    // Call function with args and context\n    const result = await fn(args, context)\n\n    return { executed: true, functionName, result }\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('not registered')) {\n      throw new Error(\n        `Workflow function \"${functionName}\" not registered in DI container (key: ${fnKey})`\n      )\n    }\n    throw error\n  }\n}\n\n/**\n * WAIT activity handler\n *\n * Delays workflow execution for a configured duration or until a specific datetime.\n * - `duration`: relative delay (e.g. \"PT5M\", \"1h\", \"30s\")\n * - `until`: absolute datetime (e.g. \"2026-04-15T10:00:00Z\")\n * - Sync mode: blocks via sleep (suitable for short delays)\n * - Async mode: delay is handled by the queue's delayMs option;\n *   this handler returns immediately when called from the worker\n */\nexport async function executeWait(config: any): Promise<any> {\n  const durationMs = calculateWaitDelayMs(config)\n\n  // In sync mode, actually sleep for the duration\n  // In async mode (called from worker), the delay already happened via queue scheduling\n  await sleep(durationMs)\n\n  return { waited: true, durationMs }\n}\n\n/**\n * SET_VARIABLE activity handler\n *\n * Validates the (already interpolated) assignments and echoes them back as\n * `{ assignments }`. The sync merge points detect this output shape via\n * `isSetVariableOutput` and apply each assignment at its dot path in\n * top-level workflow context (see lib/set-variable.ts) instead of\n * namespacing the output under the activity name/type key.\n */\nexport async function executeSetVariable(\n  config: unknown,\n  context: ActivityContext\n): Promise<SetVariableOutput> {\n  const parsed = setVariableConfigSchema.safeParse(config)\n  if (!parsed.success) {\n    const issues = parsed.error.issues\n      .map((issue) => `${issue.path.join('.') || 'config'}: ${issue.message}`)\n      .join('; ')\n    throw new Error(`SET_VARIABLE config invalid: ${issues}`)\n  }\n\n  for (const assignment of parsed.data.assignments) {\n    const segments = splitAssignmentPath(assignment.path)\n    if (segments === null) {\n      throw new Error(\n        `SET_VARIABLE assignment path contains a forbidden segment (__proto__, constructor, prototype): \"${assignment.path}\"`\n      )\n    }\n    if (segments.length === 0) {\n      throw new Error(`SET_VARIABLE assignment path is blank: \"${assignment.path}\"`)\n    }\n  }\n\n  return { assignments: parsed.data.assignments }\n}\n\n/**\n * INVOKE_AGENT activity handler\n *\n * Runs a callable agent via the agent_orchestrator DI bridge (`agentWorkflowBridge`,\n * an optional peer) and dispositions any proposal:\n * - researcher \u2192 returns the agent data; the step proceeds inline (no park).\n * - auto_approved \u2192 returns the proposalId; the step proceeds inline (no park).\n * - user_task \u2192 returns a result carrying a `__park` marker so the step handler\n *   parks the instance on `INVOKE_AGENT_SIGNAL_NAME`; agent_orchestrator's\n *   dispose path later signals it to resume.\n *\n * `config` is the already-interpolated INVOKE_AGENT config.\n */\ntype AgentWorkflowBridgeLike = {\n  invokeAgentForWorkflow: (args: {\n    agentId: string\n    input: unknown\n    onResult: { autoApproveThreshold: number; autoApproveMargin?: number } | { alwaysAsk: true }\n    ctx: {\n      tenantId: string\n      organizationId: string\n      userId?: string\n      workflowInstanceId: string\n      stepId: string\n      /**\n       * The step-attempt id. With the instance and the step it IS this\n       * invocation's identity, so the run it produces can be correlated by name\n       * rather than by \"the newest run for this agent since now\".\n       */\n      invocationId?: string\n      // Optional interpolated business-record descriptor (invokeAgentConfigSchema.subject).\n      subject?: unknown\n      // Optional already-resolved Review section (spec 7.5) \u2014 who reviews the\n      // proposal this step raises, and by when. Absent means the unassigned\n      // task the disposition service raised before the section existed.\n      review?: AgentDispositionReview\n    }\n  }) => Promise<\n    | { kind: 'research'; data: unknown }\n    | { kind: 'auto_approved'; proposalId: string; payload: unknown }\n    | { kind: 'user_task'; proposalId: string }\n    // The agent proposed nothing: terminal like `researcher`, never parked.\n    | { kind: 'none_proposed'; proposalId: string; payload: unknown }\n    // The agent PRODUCED files. Terminal and non-mutating, so it routes onto the\n    // same governance handle as a research result: the five outcome handles are a\n    // vocabulary of DECISIONS, and \"it made a document\" is not one of them.\n    | { kind: 'artifact'; artifacts: unknown[]; summary?: string }\n  >\n}\n\nfunction tryResolveAgentWorkflowBridge(\n  container: AwilixContainer,\n): AgentWorkflowBridgeLike | undefined {\n  try {\n    return container.resolve<AgentWorkflowBridgeLike>('agentWorkflowBridge')\n  } catch {\n    return undefined\n  }\n}\n\nexport async function executeInvokeAgent(\n  config: unknown,\n  context: ActivityContext,\n  container: AwilixContainer\n): Promise<any> {\n  const parsed = invokeAgentConfigSchema.safeParse(config)\n  if (!parsed.success) {\n    const issues = parsed.error.issues\n      .map((issue) => `${issue.path.join('.') || 'config'}: ${issue.message}`)\n      .join('; ')\n    throw new Error(`INVOKE_AGENT config invalid: ${issues}`)\n  }\n  const { agentId, input, onResult, outputMapping, subject, review } = parsed.data\n\n  // The Review section is resolved HERE, against the context the step ran with,\n  // for the same reason a USER_TASK's assignment is resolved at creation rather\n  // than at read time: a definition edit while the agent is running must not\n  // retro-change who the resulting review task belongs to. `config` reaches this\n  // function already interpolated, so a dynamic assignee is either a resolved id\n  // or an untouched `{{\u2026}}` token \u2014 which `resolveTaskAssignment` reads as the\n  // fallback-to-the-role-queue case.\n  const dispositionReview = toAgentDispositionReview(resolveAgentReview(review, (value) => value))\n\n  // Fail fast when the optional agent_orchestrator peer is absent \u2014 the worker\n  // would otherwise enqueue a job that can never run.\n  const bridge = tryResolveAgentWorkflowBridge(container)\n  if (!bridge) {\n    throw new Error('[internal] agent_orchestrator not installed')\n  }\n\n  const stepId =\n    context.stepContext?.stepId ||\n    context.workflowInstance.currentStepId\n\n  // Resolve the traceable principal this agent run executes as, from the\n  // workflow instance (NOT the unreliable execution `context.userId`, which is\n  // empty for event/sub-workflow paths). Same security model as CALL_API: the\n  // run must never exceed the permissions of the human who triggered (or\n  // authored) the workflow, and there is no anonymous \"system\" fallback \u2014\n  // passing an empty user id downstream both poisons the DB transaction\n  // (invalid uuid `\"\"`) and would mint a session token attributed to no one.\n  const principalEm = container.resolve<PostgreSqlEntityManager>('em')\n  const effectiveUserId = await resolveWorkflowPrincipalUserId(principalEm, context.workflowInstance)\n  if (!effectiveUserId) {\n    throw new Error(\n      `[INVOKE_AGENT] Refusing to execute for workflow instance ${context.workflowInstance.id}: ` +\n      `no traceable user (instance initiatedBy or definition author) could be resolved. ` +\n      `Agent runs must execute under the identity of the user who triggered them.`\n    )\n  }\n\n  // Parallel-branch agent steps keep the legacy inline path. The async fix below\n  // parks and resumes at the INSTANCE level, and sendSignal's FORKED branch\n  // resume only matches WAIT_FOR_SIGNAL steps \u2014 so an instance-level resume would\n  // not reach a parked branch. The claims blueprints (and the common case) run\n  // agents sequentially at the instance level; only rarely-used parallel branches\n  // hit this fallback, where behavior is unchanged from before.\n  if (context.branchInstanceId) {\n    const outcome = await bridge.invokeAgentForWorkflow({\n      agentId,\n      input,\n      onResult,\n      ctx: {\n        tenantId: context.workflowInstance.tenantId,\n        organizationId: context.workflowInstance.organizationId,\n        userId: effectiveUserId,\n        workflowInstanceId: context.workflowInstance.id,\n        stepId,\n        // The step-attempt row id: a retry enters the step again and mints a new\n        // one, so it names THIS attempt and no other.\n        ...(context.stepInstanceId ? { invocationId: context.stepInstanceId } : {}),\n        ...(subject ? { subject } : {}),\n        ...(dispositionReview ? { review: dispositionReview } : {}),\n      },\n    })\n    if (outcome.kind === 'research') {\n      return { kind: 'research', agentId, data: outcome.data }\n    }\n    if (outcome.kind === 'artifact') {\n      return { kind: 'artifact', agentId, artifacts: outcome.artifacts, summary: outcome.summary }\n    }\n    if (outcome.kind === 'auto_approved' || outcome.kind === 'none_proposed') {\n      return { kind: outcome.kind, agentId, proposalId: outcome.proposalId, proposalPayload: outcome.payload }\n    }\n    return {\n      kind: 'user_task',\n      agentId,\n      proposalId: outcome.proposalId,\n      __park: { signalName: INVOKE_AGENT_SIGNAL_NAME },\n    }\n  }\n\n  if (!context.stepInstanceId) {\n    throw new Error('[internal] INVOKE_AGENT requires a step instance to park on')\n  }\n\n  // Run the agent OUTSIDE the workflow transaction. Previously the agent ran\n  // inline here, on the workflow's transactional EM: a failing statement aborted\n  // the whole workflow transaction (\"current transaction is aborted, \u2026\") and,\n  // for cross-process OpenCode agents, the per-run api_key / session rows were\n  // written into the still-open transaction so the separate mcp:serve-http\n  // process could not see them to authenticate submit_outcome. Instead we enqueue\n  // a dedicated job and PARK the step on the proposal-ready signal: the\n  // workflow-invoke-agent worker runs the agent on its own connection (committed,\n  // cross-process visible) and resumes the parked step via sendSignal. user_task\n  // outcomes stay parked until agent_orchestrator's human dispose fires the same\n  // signal \u2014 identical to the prior park behavior.\n  const queue = getInvokeAgentQueue()\n  const job: WorkflowActivityJobInvokeAgent = {\n    kind: 'invoke_agent',\n    workflowInstanceId: context.workflowInstance.id,\n    branchInstanceId: context.branchInstanceId ?? undefined,\n    stepInstanceId: context.stepInstanceId,\n    stepId,\n    signalName: INVOKE_AGENT_SIGNAL_NAME,\n    agentId,\n    input: (input ?? {}) as Record<string, any>,\n    onResult,\n    ...(outputMapping ? { outputMapping } : {}),\n    ...(subject ? { subject } : {}),\n    ...(dispositionReview ? { review: dispositionReview } : {}),\n    tenantId: context.workflowInstance.tenantId,\n    organizationId: context.workflowInstance.organizationId,\n    userId: effectiveUserId,\n  }\n  const jobId = await queue.enqueue(job, { delayMs: INVOKE_AGENT_ENQUEUE_DELAY_MS })\n\n  return {\n    kind: 'pending_agent',\n    agentId,\n    jobId,\n    __park: { signalName: INVOKE_AGENT_SIGNAL_NAME },\n  }\n}\n\n/**\n * CALL_API activity handler\n *\n * Makes authenticated HTTP request to internal Open Mercato APIs\n * - Automatically creates one-time API key for authentication\n * - Injects tenant/organization context headers\n * - Validates URL security (SSRF prevention)\n * - Classifies errors (retriable vs non-retriable)\n * - Deletes API key after request (no stored credentials!)\n */\nexport async function executeCallApi(\n  em: EntityManager,\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer,\n  signal?: AbortSignal\n): Promise<any> {\n  // 1. Interpolate variables in config (including {{workflow.*}}, {{context.*}}, allowlisted {{env.*}}, {{now}})\n  const interpolatedConfig = interpolateActivityConfig(config, context, 'CALL_API')\n\n  const {\n    endpoint,\n    method = 'GET',\n    headers = {},\n    body,\n    validateTenantMatch = true,\n  } = interpolatedConfig\n\n\n  if (!endpoint) {\n    throw new Error('CALL_API requires \"endpoint\" field')\n  }\n\n  // 2. Build full URL (prepend APP_URL for relative paths)\n  const fullUrl = buildApiUrl(endpoint)\n\n  // 3. Import the one-time API key helper\n  const { withOnetimeApiKey } = await import('../../api_keys/services/apiKeyService')\n\n  // 4. Create the one-time API key on an EntityManager that is fully detached\n  //    from the surrounding request/transaction context.\n  //\n  //    CALL_API runs inside `workflowExecutor.executeWorkflow()`, which wraps\n  //    the whole execution in `em.transactional(...)`. The request EM is forked\n  //    with `useContext: true`, so while that transaction is open, EVERY\n  //    operation on the container's `em` \u2014 including this API key's\n  //    persist/flush \u2014 is transparently redirected to the uncommitted\n  //    transaction fork (MikroORM `getContext()` \u2192 `TransactionContext`). The\n  //    key would therefore stay invisible until the transaction commits, but\n  //    the commit cannot happen until this activity returns. The outbound\n  //    self-authenticated `fetch` below opens a SEPARATE DB connection that\n  //    cannot see the uncommitted row, so the internal API responds `401` and\n  //    the activity fails (issue #4202).\n  //\n  //    Forking with `useContext: false` (matching the query_index/webhooks\n  //    isolated-EM convention) gives the key its own pooled connection with\n  //    autocommit, so it is committed and visible to the internal request\n  //    immediately.\n  const apiKeyEm = container\n    .resolve<PostgreSqlEntityManager>('em')\n    .fork({ clear: true, freshEventManager: true, useContext: false }) as PostgreSqlEntityManager\n\n  // 5. Resolve the roles that the one-time API key will inherit.\n  //\n  // SECURITY: The key must never exceed the permissions of the human who\n  //   triggered (or authored) this workflow. Previously this code looked up\n  //   a role named \"admin\"/\"superadmin\" for the tenant and assigned it to\n  //   the key \u2014 which allowed any non-admin workflow author with\n  //   `workflows.definitions.edit` + `workflows.instances.create` to issue\n  //   arbitrary administrative API calls via a CALL_API activity. See the\n  //   SECURITY.md changelog entry for this fix.\n  //\n  //   The resolution strategy is:\n  //     1. Use the workflow instance's `metadata.initiatedBy` user (whoever\n  //        manually started the instance), when available. Only this user's\n  //        current active roles are used \u2014 we never fall back to the author\n  //        when the initiator is known, because that would escalate the\n  //        initiator's privileges.\n  //     2. Fall back to the workflow definition's `createdBy` (author) only\n  //        when the instance was started by an event trigger with no user.\n  //     3. If no traceable principal exists, the activity refuses to run \u2014\n  //        there is no \"system\" fallback that bypasses RBAC.\n  const resolvedRoleIds = await resolveCallApiRoleIds(apiKeyEm, context.workflowInstance)\n\n  if (resolvedRoleIds.length === 0) {\n    throw new Error(\n      `[CALL_API] Refusing to execute CALL_API for workflow instance ${context.workflowInstance.id}: ` +\n      `no traceable user roles could be resolved from the workflow instance or definition. ` +\n      `CALL_API activities must run under the identity of the user who triggered them.`\n    )\n  }\n\n  // 6. Execute request with one-time API key scoped to the resolved user's roles\n  return await withOnetimeApiKey(\n    apiKeyEm,\n    {\n      name: `__workflow_${context.workflowInstance.id}__`,\n      description: `One-time key for workflow ${context.workflowInstance.workflowId} instance ${context.workflowInstance.id}`,\n      tenantId: context.workflowInstance.tenantId,\n      organizationId: context.workflowInstance.organizationId,\n      roles: resolvedRoleIds,\n      expiresAt: null,\n    },\n    async (apiKeySecret) => {\n      // Build request headers (auth + context + custom)\n      const requestHeaders: Record<string, string> = {\n        'Content-Type': 'application/json',\n        'Authorization': `apikey ${apiKeySecret}`,\n        'X-Tenant-Id': context.workflowInstance.tenantId,\n        'X-Organization-Id': context.workflowInstance.organizationId,\n        'X-Workflow-Instance-Id': context.workflowInstance.id,\n        ...headers,\n      }\n\n      // Make HTTP request\n      const response = await fetch(fullUrl, {\n        method,\n        headers: requestHeaders,\n        body: body ? JSON.stringify(body) : undefined,\n        signal,\n      })\n\n      // Parse response body (JSON-safe)\n      let responseBody: any\n      const contentType = response.headers.get('content-type')\n\n      try {\n        if (contentType && contentType.includes('application/json')) {\n          responseBody = await response.json()\n        } else {\n          responseBody = await response.text()\n        }\n      } catch (error) {\n        responseBody = null\n      }\n\n      // Check for HTTP errors and classify\n      if (!response.ok) {\n        classifyAndThrowError(response.status, responseBody, fullUrl)\n      }\n\n      // Validate tenant match (security check)\n      if (validateTenantMatch && responseBody && typeof responseBody === 'object') {\n        if (responseBody.tenantId && responseBody.tenantId !== context.workflowInstance.tenantId) {\n          throw new Error(\n            `Tenant ID mismatch: workflow expects ${context.workflowInstance.tenantId} but API returned ${responseBody.tenantId}`\n          )\n        }\n      }\n\n      // Return structured result\n      return {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n        body: responseBody,\n        authenticated: true,\n        tenantId: context.workflowInstance.tenantId,\n        organizationId: context.workflowInstance.organizationId,\n      }\n    }\n  )\n}\n\n// ============================================================================\n// CALL_API Helper Functions\n// ============================================================================\n\nexport type CallApiInstanceLike = {\n  id: string\n  tenantId: string\n  organizationId: string\n  definitionId: string\n  metadata?: { initiatedBy?: string | null } | null\n}\n\nasync function resolveActiveRoleIdsForUser(\n  em: any,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<string[]> {\n  const { findOneWithDecryption, findWithDecryption } = await import('@open-mercato/shared/lib/encryption/find')\n  const { User, UserRole, Role } = await import('../../auth/data/entities')\n\n  const user = await findOneWithDecryption(em, User, {\n    id: userId,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  }, {}, scope)\n  if (!user) return []\n\n  const userRoles = await findWithDecryption(\n    em,\n    UserRole,\n    { user: user.id, deletedAt: null },\n    { populate: ['role'] },\n    scope,\n  )\n  const roleIds = userRoles\n    .map((ur: any) => (typeof ur.role === 'string' ? ur.role : ur.role?.id))\n    .filter((id: unknown): id is string => typeof id === 'string' && id.length > 0)\n\n  if (roleIds.length === 0) return []\n\n  const scopedRoles = await findWithDecryption(em, Role, {\n    id: { $in: roleIds },\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  }, {}, scope)\n  return scopedRoles.map((r: any) => r.id as string)\n}\n\n/**\n * Loads the instance's definition (including soft-deleted rows, so an execution\n * grant on a deleted definition still binds a run that is still executing).\n */\nasync function loadInstanceDefinition(em: any, instance: CallApiInstanceLike) {\n  if (!instance.definitionId) return null\n  const { findOneWithDecryption } = await import('@open-mercato/shared/lib/encryption/find')\n  const { WorkflowDefinition } = await import('../data/entities')\n  return findOneWithDecryption(\n    em,\n    WorkflowDefinition,\n    { id: instance.definitionId, tenantId: instance.tenantId },\n    {},\n    { tenantId: instance.tenantId, organizationId: instance.organizationId },\n  )\n}\n\nexport async function resolveCallApiRoleIds(\n  em: any,\n  instance: CallApiInstanceLike\n): Promise<string[]> {\n  if (!instance.definitionId) return []\n\n  const scope = { tenantId: instance.tenantId, organizationId: instance.organizationId }\n  const definition = await loadInstanceDefinition(em, instance)\n\n  // 0. A definition that declares its own execution grant ALWAYS acts as its\n  //    own least-privilege principal, whoever started the run \u2014 otherwise a\n  //    CALL_API activity would mint a key carrying the starting admin's roles\n  //    and route straight around the grant.\n  if (definitionDeclaresGrant(definition)) {\n    const principalUserId = await resolveWorkflowDefinitionExecutionUserId(em, definition, null)\n    return principalUserId ? resolveActiveRoleIdsForUser(em, principalUserId, scope) : []\n  }\n\n  // 1. Prefer the triggering user (whoever manually started this instance).\n  //    WorkflowInstance.metadata.initiatedBy is the canonical record of that\n  //    principal for user-started instances; use their current role set so\n  //    CALL_API never exceeds the initiator's permissions. Refuse if the\n  //    initiator has no active scoped roles \u2014 do not fall back to the\n  //    definition author, which would escalate the initiator's privileges.\n  const initiatorUserId = instance.metadata?.initiatedBy ?? null\n  if (initiatorUserId) {\n    return resolveActiveRoleIdsForUser(em, initiatorUserId, scope)\n  }\n\n  // 2. Event-triggered instance with no human initiator: fall back to the\n  //    definition author. Soft-deleted definitions must not mint keys.\n  const authorUserId = definition?.deletedAt ? null : definition?.createdBy\n  if (!authorUserId) return []\n\n  return resolveActiveRoleIdsForUser(em, authorUserId, scope)\n}\n\n/**\n * Resolve the traceable principal user id an INVOKE_AGENT run executes as.\n *\n * Mirrors `resolveCallApiRoleIds`' principal chain so workflow-originated agent\n * runs carry the same audited identity as CALL_API:\n *   1. The instance's `metadata.initiatedBy` (whoever started it; inherited by\n *      sub-workflows from the parent instance).\n *   2. The definition's `createdBy` (author) for event-triggered instances with\n *      no human initiator. Soft-deleted definitions resolve to no principal.\n *\n * Both are outranked by the definition's own `grantedFeatures` execution\n * principal when it declares one (see `lib/definition-grant.ts`).\n *\n * Returns `null` when no traceable principal exists \u2014 callers MUST refuse rather\n * than fall back to an empty/anonymous user id (which breaks uuid columns and\n * bypasses RBAC attribution).\n */\nexport async function resolveWorkflowPrincipalUserId(\n  em: any,\n  instance: CallApiInstanceLike\n): Promise<string | null> {\n  const definition = await loadInstanceDefinition(em, instance)\n\n  // 0. A declared execution grant outranks both \u2014 the run acts as its own\n  //    principal regardless of who started it.\n  if (definitionDeclaresGrant(definition)) {\n    return resolveWorkflowDefinitionExecutionUserId(em, definition, null)\n  }\n\n  const initiatorUserId = instance.metadata?.initiatedBy ?? null\n  if (initiatorUserId) return initiatorUserId\n\n  if (definition?.deletedAt) return null\n  return definition?.createdBy ?? null\n}\n\n/**\n * Build full API URL from endpoint\n * - Relative paths (/api/...) \u2192 prepend APP_URL\n * - Absolute URLs \u2192 validate domain matches APP_URL (SSRF prevention)\n */\nfunction buildApiUrl(endpoint: string): string {\n  const appUrl = process.env.APP_URL || 'http://localhost:3000'\n\n  // Relative path - prepend APP_URL\n  if (endpoint.startsWith('/')) {\n    // Security: Only allow /api/* paths\n    if (!endpoint.startsWith('/api/')) {\n      throw new Error(`CALL_API only supports /api/* paths, got: ${endpoint}`)\n    }\n    return `${appUrl}${endpoint}`\n  }\n\n  // Absolute URL - validate domain matches APP_URL (SSRF prevention)\n  try {\n    const endpointUrl = new URL(endpoint)\n    const appUrlObj = new URL(appUrl)\n\n    if (endpointUrl.host !== appUrlObj.host) {\n      throw new Error(\n        `SSRF Prevention: CALL_API endpoint domain (${endpointUrl.host}) does not match APP_URL (${appUrlObj.host})`\n      )\n    }\n\n    return endpoint\n  } catch (error) {\n    if (error instanceof TypeError) {\n      throw new Error(`Invalid endpoint URL: ${endpoint}`)\n    }\n    throw error\n  }\n}\n\n/**\n * Classify HTTP error and throw appropriate error\n * - 400-499: Non-retriable (client error - validation/auth)\n * - 500-599: Retriable (server error)\n */\nfunction classifyAndThrowError(status: number, body: any, url: string): never {\n  const bodyStr = typeof body === 'string' ? body : JSON.stringify(body)\n\n  if (status >= 400 && status < 500) {\n    // Client errors - non-retriable\n    throw new Error(\n      `CALL_API request failed with status ${status} (non-retriable): ${bodyStr}`\n    )\n  }\n\n  if (status >= 500) {\n    // Server errors - retriable\n    const error: any = new Error(\n      `CALL_API request failed with status ${status} (retriable): ${bodyStr}`\n    )\n    error.retriable = true\n    throw error\n  }\n\n  // Other errors\n  throw new Error(`CALL_API request failed with status ${status}: ${bodyStr}`)\n}\n\n// ============================================================================\n// Helper Functions\n// ============================================================================\n\ntype InterpolationBaseResolution =\n  | { status: 'resolved'; value: unknown }\n  | { status: 'unresolved-context'; contextPath: string }\n  | { status: 'unknown-workflow-key'; workflowKey: string }\n  | { status: 'env-not-allowlisted'; envKey: string }\n\nfunction resolveInterpolationBaseValue(\n  path: string,\n  context: Record<string, any>,\n  workflowInstance?: WorkflowInstance\n): InterpolationBaseResolution {\n  if (path.startsWith('workflow.') && workflowInstance) {\n    const workflowKey = path.substring('workflow.'.length)\n    switch (workflowKey) {\n      case 'instanceId':\n        return { status: 'resolved', value: workflowInstance.id }\n      case 'tenantId':\n        return { status: 'resolved', value: workflowInstance.tenantId }\n      case 'organizationId':\n        return { status: 'resolved', value: workflowInstance.organizationId }\n      case 'currentStepId':\n        return { status: 'resolved', value: workflowInstance.currentStepId }\n      case 'workflowId':\n        return { status: 'resolved', value: workflowInstance.workflowId }\n      case 'version':\n        return { status: 'resolved', value: workflowInstance.version }\n      default:\n        return { status: 'unknown-workflow-key', workflowKey }\n    }\n  }\n\n  if (path.startsWith('env.')) {\n    const envKey = path.substring('env.'.length)\n    if (!getWorkflowEnvInterpolationAllowlist().has(envKey)) {\n      return { status: 'env-not-allowlisted', envKey }\n    }\n    return { status: 'resolved', value: process.env[envKey] ?? '' }\n  }\n\n  if (path === 'now') {\n    return { status: 'resolved', value: new Date().toISOString() }\n  }\n\n  const contextPath = path.startsWith('context.') ? path.substring('context.'.length) : path\n  const value = getNestedValue(context, contextPath)\n  if (value !== undefined) return { status: 'resolved', value }\n  return { status: 'unresolved-context', contextPath }\n}\n\nfunction strictInterpolationError(rawToken: string, reason: string): WorkflowInterpolationError {\n  return new WorkflowInterpolationError(\n    `Cannot interpolate {{${rawToken}}}: ${reason}`,\n    rawToken\n  )\n}\n\nfunction interpolateToken(\n  rawToken: string,\n  context: Record<string, any>,\n  workflowInstance: WorkflowInstance | undefined,\n  strict: boolean\n): { resolved: boolean; value?: unknown } {\n  const parsedToken = parseInterpolationToken(rawToken)\n  if (!parsedToken.ok) {\n    if (strict) throw strictInterpolationError(rawToken, parsedToken.error)\n    return { resolved: false }\n  }\n  const resolution = resolveInterpolationBaseValue(parsedToken.path, context, workflowInstance)\n  if (resolution.status === 'unknown-workflow-key') {\n    if (strict) throw strictInterpolationError(rawToken, `unknown workflow key \"${resolution.workflowKey}\"`)\n    return { resolved: false }\n  }\n  if (resolution.status === 'env-not-allowlisted') {\n    if (strict) throw strictInterpolationError(rawToken, `env variable \"${resolution.envKey}\" is not allowlisted`)\n  }\n  const baseValue =\n    resolution.status === 'resolved'\n      ? resolution.value\n      : resolution.status === 'env-not-allowlisted'\n        ? ''\n        : undefined\n  if (parsedToken.transforms.length === 0) {\n    if (resolution.status === 'unresolved-context') {\n      if (strict) throw strictInterpolationError(rawToken, `context path \"${resolution.contextPath}\" is not defined`)\n      return { resolved: false }\n    }\n    return { resolved: true, value: baseValue }\n  }\n  const transformed = applyTransforms(baseValue, parsedToken.transforms)\n  if (!transformed.ok) {\n    if (strict) throw strictInterpolationError(rawToken, transformed.error.message)\n    return { resolved: false }\n  }\n  if (transformed.value === undefined) {\n    if (strict) throw strictInterpolationError(rawToken, 'the transform pipeline produced no value')\n    return { resolved: false }\n  }\n  return { resolved: true, value: transformed.value }\n}\n\n/**\n * Interpolate variables in config from workflow context\n *\n * Supports syntax:\n * - {{context.field}} or {{context.nested.field}} - from workflow context\n * - {{workflow.instanceId}} - workflow instance ID\n * - {{workflow.tenantId}} - tenant ID\n * - {{workflow.organizationId}} - organization ID\n * - {{workflow.currentStepId}} - current step ID\n * - {{env.VAR_NAME}} - server-allowlisted environment variables\n * - {{now}} - current ISO timestamp\n * - {{ path | transform(args) | ... }} - pill transform pipeline\n *   (`lib/interpolation-pipeline.ts`): a fixed table of pure transforms folded\n *   over the resolved base value. Lenient behavior (the default): an\n *   unparseable token, an unresolved path without a rescuing `default`, or a\n *   failed transform passes the original token/config through unchanged. In\n *   strict mode (`options.mode: 'strict'`, opted in per definition) the same\n *   situations throw `WorkflowInterpolationError` naming the offending token;\n *   only a `default(...)` transform can rescue an unresolved context path.\n */\nexport function interpolateVariables(\n  config: any,\n  context: Record<string, any>,\n  workflowInstance?: WorkflowInstance,\n  options?: { mode?: WorkflowInterpolationMode }\n): any {\n  const strict = options?.mode === 'strict'\n  if (typeof config === 'string') {\n    // Check if this is a single variable reference (e.g., \"{{context.cart.items}}\")\n    // This preserves the original type (array, object, number, boolean)\n    const singleVarMatch = config.match(/^\\{\\{([^}]+)\\}\\}$/)\n\n    if (singleVarMatch) {\n      const outcome = interpolateToken(singleVarMatch[1], context, workflowInstance, strict)\n      return outcome.resolved ? outcome.value : config\n    }\n\n    // Multiple interpolations or mixed text - return string\n    return config.replace(/\\{\\{([^}]+)\\}\\}/g, (match, token) => {\n      const outcome = interpolateToken(token, context, workflowInstance, strict)\n      return outcome.resolved ? String(outcome.value) : match\n    })\n  }\n\n  if (Array.isArray(config)) {\n    return config.map((item) => interpolateVariables(item, context, workflowInstance, options))\n  }\n\n  if (config && typeof config === 'object') {\n    const result: Record<string, any> = {}\n    for (const [key, value] of Object.entries(config)) {\n      result[key] = interpolateVariables(value, context, workflowInstance, options)\n    }\n    return result\n  }\n\n  return config\n}\n\nfunction interpolateActivityConfig(\n  config: any,\n  context: ActivityContext,\n  activityType: ActivityType,\n  activityName?: string\n): any {\n  try {\n    return interpolateVariables(config, context.workflowContext, context.workflowInstance, {\n      mode: context.interpolationMode,\n    })\n  } catch (error) {\n    if (error instanceof WorkflowInterpolationError) {\n      throw new ActivityExecutionError(error.message, activityType, activityName, { token: error.token })\n    }\n    throw error\n  }\n}\n\n/**\n * Get nested value from object by path (e.g., \"user.email\")\n */\nfunction getNestedValue(obj: any, path: string): any {\n  const parts = path.split('.')\n  let value = obj\n\n  for (const part of parts) {\n    if (value && typeof value === 'object' && part in value) {\n      value = value[part]\n    } else {\n      return undefined\n    }\n  }\n\n  return value\n}\n\n/**\n * Calculate exponential backoff delay\n */\nfunction calculateBackoff(\n  initialIntervalMs: number,\n  backoffCoefficient: number,\n  attempt: number,\n  maxIntervalMs: number\n): number {\n  const backoff = initialIntervalMs * Math.pow(backoffCoefficient, attempt)\n  return Math.min(backoff, maxIntervalMs || Infinity)\n}\n\n/**\n * Sleep for specified milliseconds\n */\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\n/**\n * Execute a promise with timeout\n *\n * Only CALL_API and CALL_WEBHOOK honour the abort signal today \u2014 they forward\n * it to `fetch`. SEND_EMAIL, EMIT_EVENT, UPDATE_ENTITY and EXECUTE_FUNCTION\n * still run to completion after the timeout has been recorded. Tracked in\n * #5148.\n */\nasync function executeWithTimeout<T>(\n  executor: (signal: AbortSignal) => Promise<T>,\n  timeoutMs: number\n): Promise<T> {\n  let timeoutId: NodeJS.Timeout\n  const abortController = new AbortController()\n\n  const timeoutPromise = new Promise<never>((_, reject) => {\n    timeoutId = setTimeout(() => {\n      abortController.abort()\n      reject(new Error(`Activity execution timeout after ${timeoutMs}ms`))\n    }, timeoutMs)\n  })\n\n  try {\n    return await Promise.race([executor(abortController.signal), timeoutPromise])\n  } finally {\n    clearTimeout(timeoutId!)\n  }\n}\n\nbindActivityExecutor({\n  executeSendEmail,\n  executeEmitEvent,\n  executeUpdateEntity,\n  executeCallWebhook,\n  executeFunction,\n  executeCallApi,\n  executeSetVariable,\n  executeInvokeAgent,\n})\n"],
-  "mappings": "AAgBA,SAAS,yBAAgC;AAEzC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,+BAA+B;AACxC,SAAS,2CAA2C;AAEpD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAEP,SAAS,0CAA0E;AACnF;AAAA,EAGE;AAAA,EACA;AAAA,OACK;AACP,OAAO;AACP,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,4BAA2C;AAEpD,SAAS,wBAAAA,6BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,gDAAgD;AACzD,SAAS,oBAAoB,gCAAgC;AAG7D,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,SAAS,2CAAoD;AAC3D,MAAI,wBAAwB,QAAQ,IAAI,iCAAiC,KAAK,GAAG;AAC/E,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,aAAO,KAAK,sGAAsG,EAAE,WAAW,eAAe,CAAC;AAC/I,aAAO;AAAA,IACT;AAEA,WAAO,KAAK,2HAA2H,EAAE,WAAW,eAAe,CAAC;AACpK,WAAO;AAAA,EACT;AAEA,MAAI,wBAAwB,QAAQ,IAAI,qCAAqC,KAAK,GAAG;AACnF,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,aAAO,KAAK,2KAA2K,EAAE,WAAW,eAAe,CAAC;AACpN,aAAO;AAAA,IACT;AAEA,WAAO,KAAK,gIAAgI,EAAE,WAAW,eAAe,CAAC;AACzK,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,MAAM,+CAA+C,oBAAI,IAAI,CAAC,SAAS,CAAC;AACxE,MAAM,2CAA2C;AAEjD,SAAS,uCAAoD;AAC3D,QAAM,YAAY,IAAI,IAAI,4CAA4C;AACtE,QAAM,iBAAiB,QAAQ,IAAI,wCAAwC;AAC3E,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,aAAW,OAAO,eAAe,MAAM,GAAG,GAAG;AAC3C,UAAM,aAAa,IAAI,KAAK;AAC5B,QAAI,YAAY;AACd,gBAAU,IAAI,UAAU;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO;AACT;AAuBO,MAAM,2BAA2B;AAQjC,MAAM,2BAA2B;AAQjC,MAAM,gCAAgC;AAUtC,SAAS,sBAAsB,QAA4C;AAChF,MAAI,UAAU,OAAO,WAAW,YAAY,YAAY,QAAQ;AAC9D,UAAM,OAAQ,OAAgC;AAC9C,QAAI,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAkC,eAAe,UAAU;AACzG,aAAO,EAAE,YAAa,KAAgC,WAAW;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAmDA,eAAe,2BACb,WACA,QACA,UACA,UACA,gBACkB;AAClB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,MAAM,oBAAoB;AAC5B,aAAO,MAAM,KAAK,mBAAmB,QAAQ,CAAC,GAAG,QAAQ,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAC1F;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAsBO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YACE,SACO,cACA,cACA,SACP;AACA,UAAM,OAAO;AAJN;AACA;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AASO,MAAM,mCAAmC,MAAM;AAAA,EACpD,YACE,SACO,OACP;AACA,UAAM,OAAO;AAFN;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAMA,IAAI,gBAAmD;AACvD,IAAI,mBAAsD;AAK1D,SAAS,mBAA+C;AACtD,MAAI,CAAC,eAAe;AAClB,oBAAgB;AAAA,MACd;AAAA,MACA,EAAE,aAAa,SAAS,QAAQ,IAAI,+BAA+B,GAAG,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,SAAO;AACT;AASA,SAAS,sBAAkD;AACzD,MAAI,CAAC,kBAAkB;AACrB,uBAAmB;AAAA,MACjB;AAAA,MACA,EAAE,aAAa,SAAS,QAAQ,IAAI,6CAA6C,KAAK,EAAE,EAAE;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO;AACT;AAUA,eAAsB,gBACpB,IACA,UACA,SACiB;AACjB,QAAM,EAAE,kBAAkB,iBAAiB,aAAa,cAAc,gBAAgB,iBAAiB,IACrG;AAEF,QAAM,gBAAgB,gBAAgB,SAAS,YAAY;AAC3D,MAAI,iBAAiB,cAAc,MAAM,YAAY,OAAO;AAC1D,UAAM,IAAI;AAAA,MACR,4BAA4B,SAAS,YAAY,+BAA+B,cAAc,MAAM,MAAM;AAAA,MAC1G,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAIA,QAAM,qBAAqB;AAAA,IACzB,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AAGA,QAAM,MAA2B;AAAA,IAC/B,oBAAoB,iBAAiB;AAAA,IACrC;AAAA,IACA,kBAAkB,oBAAoB;AAAA,IACtC;AAAA,IACA,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS,gBAAgB,SAAS;AAAA,IAChD,cAAc,SAAS;AAAA,IACvB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA,aAAa,SAAS;AAAA,IACtB,WAAW,SAAS;AAAA,IACpB,UAAU,iBAAiB;AAAA,IAC3B,gBAAgB,iBAAiB;AAAA,IACjC,QAAQ,QAAQ;AAAA,EAClB;AAGA,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,kBAAkB,eAAe,iBACnC,cAAc,eAAe,kBAAkB,IAC/C;AACJ,QAAM,iBAAiB,oBAAoB,OAAO,EAAE,SAAS,gBAAgB,IAAI;AACjF,QAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,cAAc;AAGrD,QAAM,iBAAiB,IAAI;AAAA,IACzB,oBAAoB,iBAAiB;AAAA,IACrC;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,MACT,YAAY,SAAS;AAAA,MACrB,cAAc,SAAS;AAAA,MACvB,cAAc,SAAS;AAAA,MACvB,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,UAAU,iBAAiB;AAAA,IAC3B,gBAAgB,iBAAiB;AAAA,EACnC,CAAC;AAED,SAAO;AACT;AAQA,eAAsB,gBAAgB,QASlB;AAClB,QAAM,EAAE,oBAAoB,gBAAgB,kBAAkB,UAAU,gBAAgB,QAAQ,QAAQ,QAAQ,IAC9G;AAEF,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,QAAQ,MAAM,MAAM;AAAA,IACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,kBAAkB,oBAAoB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,UAAU,OAAU;AAAA,EAC/C;AAEA,SAAO;AACT;AAYA,eAAsB,kBAAkB,QAYpB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,QAAQ,iBAAiB;AAC/B,SAAO,MAAM,MAAM;AAAA,IACjB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,kBAAkB,oBAAoB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,UAAU,OAAU;AAAA,EAC/C;AACF;AAUA,eAAsB,yBAAyB,QAU3B;AAClB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,QAAQ,MAAM,MAAM;AAAA,IACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,kBAAkB,oBAAoB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,UAAU,OAAU;AAAA,EAC/C;AAEA,SAAO;AACT;AAeA,eAAsB,gBACpB,IACA,WACA,UACA,SACkC;AAClC,QAAM,cAAc,SAAS,eAAe;AAAA,IAC1C,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,oBAAoB;AAAA,IACpB,eAAe;AAAA,EACjB;AAEA,MAAI;AACJ,MAAI,aAAa;AAEjB,WAAS,UAAU,GAAG,UAAU,YAAY,aAAa,WAAW;AAClE,QAAI;AACF,YAAM,YAAY,KAAK,IAAI;AAI3B,YAAM,YAAY,yBAAyB,QAAQ;AACnD,YAAM,SAAS,YACX,MAAM;AAAA,QACJ,CAAC,WAAW,sBAAsB,IAAI,WAAW,UAAU,SAAS,MAAM;AAAA,QAC1E;AAAA,MACF,IACA,MAAM,sBAAsB,IAAI,WAAW,UAAU,OAAO;AAEhE,YAAM,kBAAkB,KAAK,IAAI,IAAI;AAErC,aAAO;AAAA,QACL,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS;AAAA,QACvB,cAAc,SAAS;AAAA,QACvB,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ;AAAA,QACA,OAAO,SAAS,SAAS;AAAA,MAC3B;AAAA,IACF,SAAS,OAAO;AACd,kBAAY;AACZ,mBAAa,UAAU;AAKvB,UAAI,gBAAgB,KAAK,EAAG;AAG5B,UAAI,UAAU,YAAY,cAAc,GAAG;AACzC,eAAO,MAAM,+BAA+B;AAAA,UAC1C,YAAY,SAAS;AAAA,UACrB,cAAc,SAAS;AAAA,UACvB,SAAS,UAAU;AAAA,UACnB,aAAa,YAAY;AAAA,UACzB,YAAY,QAAQ,iBAAiB;AAAA,UACrC,KAAK;AAAA,QACP,CAAC;AAAA,MACH;AAGA,UAAI,UAAU,YAAY,cAAc,GAAG;AACzC,cAAM,UAAU;AAAA,UACd,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ;AAAA,UACA,YAAY;AAAA,QACd;AAEA,cAAM,MAAM,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,eAAe,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS;AACtF,MAAI,gBAAgB,SAAS,GAAG;AAC9B,WAAO;AAAA,MACL,YAAY,SAAS;AAAA,MACrB,cAAc,SAAS;AAAA,MACvB,cAAc,SAAS;AAAA,MACvB,SAAS;AAAA,MACT,eAAe;AAAA,MACf,OAAO,kCAAkC,UAAU,YAAY,yBAAyB,UAAU,MAAM;AAAA,MACxG,YAAY;AAAA,MACZ,iBAAiB;AAAA,MACjB,OAAO,SAAS,SAAS;AAAA,IAC3B;AAAA,EACF;AACA,SAAO,MAAM,sCAAsC;AAAA,IACjD,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS;AAAA,IACvB,UAAU;AAAA,IACV,YAAY,QAAQ,iBAAiB;AAAA,IACrC,KAAK;AAAA,EACP,CAAC;AAED,SAAO;AAAA,IACL,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS;AAAA,IACvB,cAAc,SAAS;AAAA,IACvB,SAAS;AAAA,IACT,OAAO,yBAAyB,UAAU,cAAc,YAAY;AAAA,IACpE;AAAA,IACA,iBAAiB;AAAA,IACjB,OAAO,SAAS,SAAS;AAAA,EAC3B;AACF;AAYA,eAAsB,kBACpB,IACA,WACA,YACA,SACoC;AACpC,QAAM,UAAqC,CAAC;AAM5C,QAAM,mBAAmB,iBAAiB,QAAQ,gBAAgB;AAElE,WAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AAC1C,UAAM,WAAW,WAAW,CAAC;AAG7B,QAAI,SAAS,SAAS,CAAC,kBAAkB;AAEvC,YAAM,QAAQ,MAAM,gBAAgB,IAAI,UAAU,OAAO;AAEzD,cAAQ,KAAK;AAAA,QACX,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS;AAAA,QACvB,cAAc,SAAS;AAAA,QACvB,SAAS;AAAA;AAAA,QACT,OAAO;AAAA,QACP;AAAA,QACA,YAAY;AAAA,QACZ,iBAAiB;AAAA,MACnB,CAAC;AAAA,IACH,OAAO;AAEL,YAAM,WAAW,MAAM,gBAAgB,IAAI,WAAW,UAAU,OAAO;AAQvE,YAAM,SAAS,oBAAoB,SAAS,QACxC,EAAE,GAAG,UAAU,OAAO,MAAM,IAC5B;AACJ,cAAQ,KAAK,MAAM;AAGnB,UAAI,CAAC,OAAO,SAAS;AACnB;AAAA,MACF;AAKA,UAAI,OAAO,UAAU,OAAO,OAAO,WAAW,UAAU;AACtD,YAAI,SAAS,iBAAiB,kBAAkB,oBAAoB,OAAO,MAAM,GAAG;AAClF,kBAAQ,kBAAkB;AAAA,YACxB,GAAG,QAAQ;AAAA,YACX,GAAG,6BAA6B,QAAQ,iBAAiB,OAAO,OAAO,WAAW;AAAA,UACpF;AAAA,QACF,OAAO;AACL,gBAAM,MAAM,SAAS,gBAAgB,SAAS;AAC9C,kBAAQ,kBAAkB;AAAA,YACxB,GAAG,QAAQ;AAAA,YACX,CAAC,GAAG,GAAG,OAAO;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,eAAe,sBACb,IACA,WACA,UACA,SACA,QACc;AAEd,QAAM,qBAAqB;AAAA,IACzB,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AAEA,QAAM,QAAQ,gBAAgB,SAAS,YAAY;AACnD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,0BAA0B,SAAS,YAAY;AAAA,MAC/C,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAOA,MAAI,iBAAiB,QAAQ,gBAAgB,GAAG;AAC9C,QAAI,MAAM,SAAS,YAAY,MAAM,SAAS,QAAW;AACvD,YAAM,UAAU,IAAI;AAAA,QAClB,SAAS;AAAA,QACT,MAAM,SAAS,WAAW,YAAY;AAAA,QACtC,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,IAAI;AAAA,QACzB,oBAAoB,QAAQ,iBAAiB;AAAA,QAC7C,gBAAgB,QAAQ;AAAA,QACxB,WAAW,oBAAoB;AAAA,QAC/B,WAAW;AAAA,UACT,YAAY,SAAS;AAAA,UACrB,cAAc,SAAS;AAAA,UACvB,cAAc,SAAS;AAAA,UACvB,QAAQ,QAAQ;AAAA,QAClB;AAAA,QACA,UAAU,QAAQ,iBAAiB;AAAA,QACnC,gBAAgB,QAAQ,iBAAiB;AAAA,MAC3C,CAAC;AACD,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,MAAM,KAAK,oBAAoB,OAAO;AACxD,UAAM,iBAAiB,IAAI;AAAA,MACzB,oBAAoB,QAAQ,iBAAiB;AAAA,MAC7C,gBAAgB,QAAQ;AAAA,MACxB,WAAW,oBAAoB;AAAA,MAC/B,WAAW;AAAA,QACT,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS;AAAA,QACvB,cAAc,SAAS;AAAA,QACvB,QAAQ,aAAa;AAAA,MACvB;AAAA,MACA,UAAU,QAAQ,iBAAiB;AAAA,MACnC,gBAAgB,QAAQ,iBAAiB;AAAA,IAC3C,CAAC;AACD,WAAO;AAAA,EACT;AAKA,SAAO,MAAM,MAAM,QAAQ,oBAAoB,SAAS;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AASA,eAAsB,iBACpB,QACA,SACA,WACc;AACd,QAAM,EAAE,IAAI,SAAS,UAAU,cAAc,KAAK,IAAI;AAEtD,MAAI,CAAC,MAAM,CAAC,SAAS;AACnB,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,SAAO,KAAK,+BAA+B,EAAE,WAAW,cAAc,QAAQ,CAAC;AAE/E,MAAI;AACJ,MAAI;AACF,mBAAe,UAAU,QAAkE,cAAc;AAAA,EAC3G,QAAQ;AACN,mBAAe;AAAA,EACjB;AAEA,MAAI,gBAAgB,OAAO,aAAa,SAAS,YAAY;AAC3D,UAAM,aAAa,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,WAAO,EAAE,MAAM,MAAM,IAAI,SAAS,KAAK,eAAe;AAAA,EACxD;AAEA,SAAO,KAAK,kEAAkE,EAAE,WAAW,cAAc,QAAQ,CAAC;AAClH,SAAO,EAAE,MAAM,OAAO,WAAW,MAAM,IAAI,SAAS,KAAK,WAAW,QAAQ,mBAAmB;AACjG;AAOA,eAAsB,iBACpB,QACA,SACA,WACc;AACd,QAAM,EAAE,WAAW,QAAQ,IAAI;AAE/B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAMA,MAAI,oCAAoC,SAAS,GAAG;AAClD,UAAM,IAAI,MAAM,uDAAuD,SAAS,GAAG;AAAA,EACrF;AAKA,QAAM,wBAAwB,2BAA2B,OAAO;AAChE,MAAI,sBAAsB,SAAS,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,kEAAkE,sBAAsB,KAAK,IAAI,CAAC;AAAA,IAEpG;AAAA,EACF;AAGA,QAAM,WAAW,UAAU,QAA2G,UAAU;AAEhJ,MAAI,CAAC,YAAY,OAAO,SAAS,cAAc,YAAY;AACzD,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAGA,QAAM,kBAAkB;AAAA,IACtB,GAAG;AAAA,IACH,WAAW;AAAA,MACT,oBAAoB,QAAQ,iBAAiB;AAAA,MAC7C,YAAY,QAAQ,iBAAiB;AAAA,MACrC,UAAU,QAAQ,iBAAiB;AAAA,MACnC,gBAAgB,QAAQ,iBAAiB;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,SAAS,UAAU,WAAW,iBAAiB;AAAA,IACnD,UAAU,QAAQ,iBAAiB;AAAA,IACnC,gBAAgB,QAAQ,iBAAiB;AAAA,EAC3C,CAAC;AAED,SAAO,EAAE,SAAS,MAAM,WAAW,SAAS,gBAAgB;AAC9D;AAEA,MAAM,8BAA8B;AAEpC,SAAS,2BAA2B,OAAgB,OAAO,IAAc;AACvE,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,4BAA4B,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC7D;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,QAAQ,CAAC,MAAM,UAAU,2BAA2B,MAAM,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,EAC7F;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,MAAQ,CAAC,CAAC,KAAK,MAAM,MAChD,2BAA2B,QAAQ,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK,GAAG;AAAA,IAClE;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAiCA,eAAsB,oBACpB,IACA,QACA,SACA,WACc;AACd,QAAM,EAAE,WAAW,OAAO,iBAAiB,IAAI;AAE/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,2EAA2E;AAAA,EAC7F;AAGA,QAAM,sBAAsB,uBAAuB,SAAS;AAC5D,MAAI,CAAC,qBAAqB;AACxB,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAKA,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA,QAAQ,iBAAiB;AAAA,EAC3B;AACA,MAAI,CAAC,yBAAyB,qBAAqB,aAAa,GAAG;AACjE,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,QAAM,cAAc,OAAO,QAAQ,WAAW,WAAW,QAAQ,OAAO,KAAK,IAAI;AACjF,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB,QAAQ,iBAAiB;AAAA,IACzB,QAAQ,iBAAiB;AAAA,EAC3B;AACA,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAGA,QAAM,aAAa,UAAU,QAAQ,YAAY;AAEjD,MAAI,CAAC,cAAc,OAAO,WAAW,YAAY,YAAY;AAC3D,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,iBAAiB,2BAA2B,KAAK;AACvD,MAAI,eAAe,SAAS,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR,mEAAmE,eAAe,KAAK,IAAI,CAAC;AAAA,IAE9F;AAAA,EACF;AAGA,MAAI,aAAa,EAAE,GAAG,MAAM;AAG5B,MAAI,WAAW,eAAe,kBAAkB;AAC9C,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,QAAQ,iBAAiB;AAAA,MACzB,QAAQ,iBAAiB;AAAA,IAC3B;AACA,QAAI,eAAe;AACjB,iBAAW,gBAAgB;AAAA,IAC7B;AACA,WAAO,WAAW;AAAA,EACpB;AAGA,QAAM,MAAM;AAAA,IACV;AAAA,IACA,MAAM;AAAA,MACJ,KAAK;AAAA,MACL,UAAU,QAAQ,iBAAiB;AAAA,MACnC,OAAO,QAAQ,iBAAiB;AAAA,MAChC,cAAc;AAAA,IAChB;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,QAAQ,iBAAiB;AAAA,IACjD,iBAAiB,QAAQ,iBAAiB,iBACtC,CAAC,QAAQ,iBAAiB,cAAc,IACxC;AAAA,EACN;AAGA,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,WAAW;AAAA,IAC/D,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,YAAY,UAAU;AAAA,EACxB;AACF;AAKA,eAAe,yBACb,IACA,eACA,OACA,UACA,gBACwB;AACxB,MAAI;AAEF,UAAM,EAAE,YAAY,gBAAgB,IAAI,MAAM,OAAO,uDAAuD;AAG5G,UAAM,aAAa,MAAM,GAAG,QAAQ,YAAY;AAAA,MAC9C,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,KAAK,wBAAwB,EAAE,WAAW,iBAAiB,cAAc,CAAC;AACjF,aAAO;AAAA,IACT;AAGA,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,QAAQ,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC9C,YAAY,WAAW;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,KAAK,8BAA8B,EAAE,WAAW,iBAAiB,eAAe,MAAM,CAAC;AAC9F,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,WAAW,iBAAiB,KAAK,MAAM,CAAC;AAC3F,WAAO;AAAA,EACT;AACF;AAgBA,eAAsB,mBACpB,QACA,SACA,OAAwB,CAAC,GACX;AACd,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OACzB,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AACA,QAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,KAAK,IAAI,OAAO;AAC1D,QAAM,UAAU,cAAc,CAAC;AAE/B,QAAM,eAAe,KAAK,gBAAgB,yCAAyC;AAEnF,MAAI;AACJ,MAAI;AACF,eAAW,MAAM;AAAA,MACf;AAAA,MACA;AAAA,QACE;AAAA,QACA,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAG;AAAA,QACL;AAAA,QACA,MAAM,SAAS,UAAa,SAAS,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACnE,UAAU;AAAA,QACV,QAAQ,KAAK;AAAA,MACf;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,WAAW,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,wBAAwB;AAC3C,YAAM,IAAI;AAAA,QACR,4CAA4C,MAAM,MAAM,MAAM,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,UAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,UAAM,IAAI;AAAA,MACR,2CAA2C,SAAS,MAAM,OACxD,YAAY,sBACd;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AAEvD,MAAI,eAAe,YAAY,SAAS,kBAAkB,GAAG;AAC3D,aAAS,MAAM,SAAS,KAAK;AAAA,EAC/B,OAAO;AACL,aAAS,MAAM,SAAS,KAAK;AAAA,EAC/B;AAGA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,sCAAsC,SAAS,MAAM,KAAK,KAAK,UAAU,MAAM,CAAC;AAAA,IAClF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB;AAAA,EACF;AACF;AAOA,eAAsB,gBACpB,QACA,SACA,WACc;AACd,QAAM,EAAE,cAAc,OAAO,CAAC,EAAE,IAAI;AAEpC,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAGA,QAAM,QAAQ,oBAAoB,YAAY;AAE9C,MAAI;AACF,UAAM,KAAK,UAAU,QAAQ,KAAK;AAElC,QAAI,OAAO,OAAO,YAAY;AAC5B,YAAM,IAAI,MAAM,iCAAiC,YAAY,qBAAqB;AAAA,IACpF;AAGA,UAAM,SAAS,MAAM,GAAG,MAAM,OAAO;AAErC,WAAO,EAAE,UAAU,MAAM,cAAc,OAAO;AAAA,EAChD,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,YAAM,IAAI;AAAA,QACR,sBAAsB,YAAY,0CAA0C,KAAK;AAAA,MACnF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAYA,eAAsB,YAAY,QAA2B;AAC3D,QAAM,aAAa,qBAAqB,MAAM;AAI9C,QAAM,MAAM,UAAU;AAEtB,SAAO,EAAE,QAAQ,MAAM,WAAW;AACpC;AAWA,eAAsB,mBACpB,QACA,SAC4B;AAC5B,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OACzB,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AAEA,aAAW,cAAc,OAAO,KAAK,aAAa;AAChD,UAAM,WAAW,oBAAoB,WAAW,IAAI;AACpD,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI;AAAA,QACR,mGAAmG,WAAW,IAAI;AAAA,MACpH;AAAA,IACF;AACA,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAI,MAAM,2CAA2C,WAAW,IAAI,GAAG;AAAA,IAC/E;AAAA,EACF;AAEA,SAAO,EAAE,aAAa,OAAO,KAAK,YAAY;AAChD;AAoDA,SAAS,8BACP,WACqC;AACrC,MAAI;AACF,WAAO,UAAU,QAAiC,qBAAqB;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,mBACpB,QACA,SACA,WACc;AACd,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OACzB,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AACA,QAAM,EAAE,SAAS,OAAO,UAAU,eAAe,SAAS,OAAO,IAAI,OAAO;AAS5E,QAAM,oBAAoB,yBAAyB,mBAAmB,QAAQ,CAAC,UAAU,KAAK,CAAC;AAI/F,QAAM,SAAS,8BAA8B,SAAS;AACtD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,QAAM,SACJ,QAAQ,aAAa,UACrB,QAAQ,iBAAiB;AAS3B,QAAM,cAAc,UAAU,QAAiC,IAAI;AACnE,QAAM,kBAAkB,MAAM,+BAA+B,aAAa,QAAQ,gBAAgB;AAClG,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR,4DAA4D,QAAQ,iBAAiB,EAAE;AAAA,IAGzF;AAAA,EACF;AAQA,MAAI,QAAQ,kBAAkB;AAC5B,UAAM,UAAU,MAAM,OAAO,uBAAuB;AAAA,MAClD;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,QACH,UAAU,QAAQ,iBAAiB;AAAA,QACnC,gBAAgB,QAAQ,iBAAiB;AAAA,QACzC,QAAQ;AAAA,QACR,oBAAoB,QAAQ,iBAAiB;AAAA,QAC7C;AAAA;AAAA;AAAA,QAGA,GAAI,QAAQ,iBAAiB,EAAE,cAAc,QAAQ,eAAe,IAAI,CAAC;AAAA,QACzE,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC7B,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;AAAA,MAC3D;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,SAAS,YAAY;AAC/B,aAAO,EAAE,MAAM,YAAY,SAAS,MAAM,QAAQ,KAAK;AAAA,IACzD;AACA,QAAI,QAAQ,SAAS,YAAY;AAC/B,aAAO,EAAE,MAAM,YAAY,SAAS,WAAW,QAAQ,WAAW,SAAS,QAAQ,QAAQ;AAAA,IAC7F;AACA,QAAI,QAAQ,SAAS,mBAAmB,QAAQ,SAAS,iBAAiB;AACxE,aAAO,EAAE,MAAM,QAAQ,MAAM,SAAS,YAAY,QAAQ,YAAY,iBAAiB,QAAQ,QAAQ;AAAA,IACzG;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,QAAQ,EAAE,YAAY,yBAAyB;AAAA,IACjD;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,gBAAgB;AAC3B,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAaA,QAAM,QAAQ,oBAAoB;AAClC,QAAM,MAAsC;AAAA,IAC1C,MAAM;AAAA,IACN,oBAAoB,QAAQ,iBAAiB;AAAA,IAC7C,kBAAkB,QAAQ,oBAAoB;AAAA,IAC9C,gBAAgB,QAAQ;AAAA,IACxB;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,OAAQ,SAAS,CAAC;AAAA,IAClB;AAAA,IACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;AAAA,IACzD,UAAU,QAAQ,iBAAiB;AAAA,IACnC,gBAAgB,QAAQ,iBAAiB;AAAA,IACzC,QAAQ;AAAA,EACV;AACA,QAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,EAAE,SAAS,8BAA8B,CAAC;AAEjF,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,EAAE,YAAY,yBAAyB;AAAA,EACjD;AACF;AAYA,eAAsB,eACpB,IACA,QACA,SACA,WACA,QACc;AAEd,QAAM,qBAAqB,0BAA0B,QAAQ,SAAS,UAAU;AAEhF,QAAM;AAAA,IACJ;AAAA,IACA,SAAS;AAAA,IACT,UAAU,CAAC;AAAA,IACX;AAAA,IACA,sBAAsB;AAAA,EACxB,IAAI;AAGJ,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAGA,QAAM,UAAU,YAAY,QAAQ;AAGpC,QAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,uCAAuC;AAqBlF,QAAM,WAAW,UACd,QAAiC,IAAI,EACrC,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,MAAM,CAAC;AAsBnE,QAAM,kBAAkB,MAAM,sBAAsB,UAAU,QAAQ,gBAAgB;AAEtF,MAAI,gBAAgB,WAAW,GAAG;AAChC,UAAM,IAAI;AAAA,MACR,iEAAiE,QAAQ,iBAAiB,EAAE;AAAA,IAG9F;AAAA,EACF;AAGA,SAAO,MAAM;AAAA,IACX;AAAA,IACA;AAAA,MACE,MAAM,cAAc,QAAQ,iBAAiB,EAAE;AAAA,MAC/C,aAAa,6BAA6B,QAAQ,iBAAiB,UAAU,aAAa,QAAQ,iBAAiB,EAAE;AAAA,MACrH,UAAU,QAAQ,iBAAiB;AAAA,MACnC,gBAAgB,QAAQ,iBAAiB;AAAA,MACzC,OAAO;AAAA,MACP,WAAW;AAAA,IACb;AAAA,IACA,OAAO,iBAAiB;AAEtB,YAAM,iBAAyC;AAAA,QAC7C,gBAAgB;AAAA,QAChB,iBAAiB,UAAU,YAAY;AAAA,QACvC,eAAe,QAAQ,iBAAiB;AAAA,QACxC,qBAAqB,QAAQ,iBAAiB;AAAA,QAC9C,0BAA0B,QAAQ,iBAAiB;AAAA,QACnD,GAAG;AAAA,MACL;AAGA,YAAM,WAAW,MAAM,MAAM,SAAS;AAAA,QACpC;AAAA,QACA,SAAS;AAAA,QACT,MAAM,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACpC;AAAA,MACF,CAAC;AAGD,UAAI;AACJ,YAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AAEvD,UAAI;AACF,YAAI,eAAe,YAAY,SAAS,kBAAkB,GAAG;AAC3D,yBAAe,MAAM,SAAS,KAAK;AAAA,QACrC,OAAO;AACL,yBAAe,MAAM,SAAS,KAAK;AAAA,QACrC;AAAA,MACF,SAAS,OAAO;AACd,uBAAe;AAAA,MACjB;AAGA,UAAI,CAAC,SAAS,IAAI;AAChB,8BAAsB,SAAS,QAAQ,cAAc,OAAO;AAAA,MAC9D;AAGA,UAAI,uBAAuB,gBAAgB,OAAO,iBAAiB,UAAU;AAC3E,YAAI,aAAa,YAAY,aAAa,aAAa,QAAQ,iBAAiB,UAAU;AACxF,gBAAM,IAAI;AAAA,YACR,wCAAwC,QAAQ,iBAAiB,QAAQ,qBAAqB,aAAa,QAAQ;AAAA,UACrH;AAAA,QACF;AAAA,MACF;AAGA,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,SAAS,OAAO,YAAY,SAAS,QAAQ,QAAQ,CAAC;AAAA,QACtD,MAAM;AAAA,QACN,eAAe;AAAA,QACf,UAAU,QAAQ,iBAAiB;AAAA,QACnC,gBAAgB,QAAQ,iBAAiB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACF;AAcA,eAAe,4BACb,IACA,QACA,OACmB;AACnB,QAAM,EAAE,uBAAuB,mBAAmB,IAAI,MAAM,OAAO,0CAA0C;AAC7G,QAAM,EAAE,MAAM,UAAU,KAAK,IAAI,MAAM,OAAO,0BAA0B;AAExE,QAAM,OAAO,MAAM,sBAAsB,IAAI,MAAM;AAAA,IACjD,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,KAAK;AACZ,MAAI,CAAC,KAAM,QAAO,CAAC;AAEnB,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,KAAK,IAAI,WAAW,KAAK;AAAA,IACjC,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB;AAAA,EACF;AACA,QAAM,UAAU,UACb,IAAI,CAAC,OAAa,OAAO,GAAG,SAAS,WAAW,GAAG,OAAO,GAAG,MAAM,EAAG,EACtE,OAAO,CAAC,OAA8B,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAEhF,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAElC,QAAM,cAAc,MAAM,mBAAmB,IAAI,MAAM;AAAA,IACrD,IAAI,EAAE,KAAK,QAAQ;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,KAAK;AACZ,SAAO,YAAY,IAAI,CAAC,MAAW,EAAE,EAAY;AACnD;AAMA,eAAe,uBAAuB,IAAS,UAA+B;AAC5E,MAAI,CAAC,SAAS,aAAc,QAAO;AACnC,QAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,0CAA0C;AACzF,QAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,kBAAkB;AAC9D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,SAAS,cAAc,UAAU,SAAS,SAAS;AAAA,IACzD,CAAC;AAAA,IACD,EAAE,UAAU,SAAS,UAAU,gBAAgB,SAAS,eAAe;AAAA,EACzE;AACF;AAEA,eAAsB,sBACpB,IACA,UACmB;AACnB,MAAI,CAAC,SAAS,aAAc,QAAO,CAAC;AAEpC,QAAM,QAAQ,EAAE,UAAU,SAAS,UAAU,gBAAgB,SAAS,eAAe;AACrF,QAAM,aAAa,MAAM,uBAAuB,IAAI,QAAQ;AAM5D,MAAI,wBAAwB,UAAU,GAAG;AACvC,UAAM,kBAAkB,MAAM,yCAAyC,IAAI,YAAY,IAAI;AAC3F,WAAO,kBAAkB,4BAA4B,IAAI,iBAAiB,KAAK,IAAI,CAAC;AAAA,EACtF;AAQA,QAAM,kBAAkB,SAAS,UAAU,eAAe;AAC1D,MAAI,iBAAiB;AACnB,WAAO,4BAA4B,IAAI,iBAAiB,KAAK;AAAA,EAC/D;AAIA,QAAM,eAAe,YAAY,YAAY,OAAO,YAAY;AAChE,MAAI,CAAC,aAAc,QAAO,CAAC;AAE3B,SAAO,4BAA4B,IAAI,cAAc,KAAK;AAC5D;AAmBA,eAAsB,+BACpB,IACA,UACwB;AACxB,QAAM,aAAa,MAAM,uBAAuB,IAAI,QAAQ;AAI5D,MAAI,wBAAwB,UAAU,GAAG;AACvC,WAAO,yCAAyC,IAAI,YAAY,IAAI;AAAA,EACtE;AAEA,QAAM,kBAAkB,SAAS,UAAU,eAAe;AAC1D,MAAI,gBAAiB,QAAO;AAE5B,MAAI,YAAY,UAAW,QAAO;AAClC,SAAO,YAAY,aAAa;AAClC;AAOA,SAAS,YAAY,UAA0B;AAC7C,QAAM,SAAS,QAAQ,IAAI,WAAW;AAGtC,MAAI,SAAS,WAAW,GAAG,GAAG;AAE5B,QAAI,CAAC,SAAS,WAAW,OAAO,GAAG;AACjC,YAAM,IAAI,MAAM,6CAA6C,QAAQ,EAAE;AAAA,IACzE;AACA,WAAO,GAAG,MAAM,GAAG,QAAQ;AAAA,EAC7B;AAGA,MAAI;AACF,UAAM,cAAc,IAAI,IAAI,QAAQ;AACpC,UAAM,YAAY,IAAI,IAAI,MAAM;AAEhC,QAAI,YAAY,SAAS,UAAU,MAAM;AACvC,YAAM,IAAI;AAAA,QACR,8CAA8C,YAAY,IAAI,6BAA6B,UAAU,IAAI;AAAA,MAC3G;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,WAAW;AAC9B,YAAM,IAAI,MAAM,yBAAyB,QAAQ,EAAE;AAAA,IACrD;AACA,UAAM;AAAA,EACR;AACF;AAOA,SAAS,sBAAsB,QAAgB,MAAW,KAAoB;AAC5E,QAAM,UAAU,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI;AAErE,MAAI,UAAU,OAAO,SAAS,KAAK;AAEjC,UAAM,IAAI;AAAA,MACR,uCAAuC,MAAM,qBAAqB,OAAO;AAAA,IAC3E;AAAA,EACF;AAEA,MAAI,UAAU,KAAK;AAEjB,UAAM,QAAa,IAAI;AAAA,MACrB,uCAAuC,MAAM,iBAAiB,OAAO;AAAA,IACvE;AACA,UAAM,YAAY;AAClB,UAAM;AAAA,EACR;AAGA,QAAM,IAAI,MAAM,uCAAuC,MAAM,KAAK,OAAO,EAAE;AAC7E;AAYA,SAAS,8BACP,MACA,SACA,kBAC6B;AAC7B,MAAI,KAAK,WAAW,WAAW,KAAK,kBAAkB;AACpD,UAAM,cAAc,KAAK,UAAU,YAAY,MAAM;AACrD,YAAQ,aAAa;AAAA,MACnB,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,GAAG;AAAA,MAC1D,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,SAAS;AAAA,MAChE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,eAAe;AAAA,MACtE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,cAAc;AAAA,MACrE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,WAAW;AAAA,MAClE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,QAAQ;AAAA,MAC/D;AACE,eAAO,EAAE,QAAQ,wBAAwB,YAAY;AAAA,IACzD;AAAA,EACF;AAEA,MAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,UAAM,SAAS,KAAK,UAAU,OAAO,MAAM;AAC3C,QAAI,CAAC,qCAAqC,EAAE,IAAI,MAAM,GAAG;AACvD,aAAO,EAAE,QAAQ,uBAAuB,OAAO;AAAA,IACjD;AACA,WAAO,EAAE,QAAQ,YAAY,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAG;AAAA,EAChE;AAEA,MAAI,SAAS,OAAO;AAClB,WAAO,EAAE,QAAQ,YAAY,QAAO,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,EAC/D;AAEA,QAAM,cAAc,KAAK,WAAW,UAAU,IAAI,KAAK,UAAU,WAAW,MAAM,IAAI;AACtF,QAAM,QAAQ,eAAe,SAAS,WAAW;AACjD,MAAI,UAAU,OAAW,QAAO,EAAE,QAAQ,YAAY,MAAM;AAC5D,SAAO,EAAE,QAAQ,sBAAsB,YAAY;AACrD;AAEA,SAAS,yBAAyB,UAAkB,QAA4C;AAC9F,SAAO,IAAI;AAAA,IACT,wBAAwB,QAAQ,OAAO,MAAM;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,iBACP,UACA,SACA,kBACA,QACwC;AACxC,QAAM,cAAc,wBAAwB,QAAQ;AACpD,MAAI,CAAC,YAAY,IAAI;AACnB,QAAI,OAAQ,OAAM,yBAAyB,UAAU,YAAY,KAAK;AACtE,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,QAAM,aAAa,8BAA8B,YAAY,MAAM,SAAS,gBAAgB;AAC5F,MAAI,WAAW,WAAW,wBAAwB;AAChD,QAAI,OAAQ,OAAM,yBAAyB,UAAU,yBAAyB,WAAW,WAAW,GAAG;AACvG,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,uBAAuB;AAC/C,QAAI,OAAQ,OAAM,yBAAyB,UAAU,iBAAiB,WAAW,MAAM,sBAAsB;AAAA,EAC/G;AACA,QAAM,YACJ,WAAW,WAAW,aAClB,WAAW,QACX,WAAW,WAAW,wBACpB,KACA;AACR,MAAI,YAAY,WAAW,WAAW,GAAG;AACvC,QAAI,WAAW,WAAW,sBAAsB;AAC9C,UAAI,OAAQ,OAAM,yBAAyB,UAAU,iBAAiB,WAAW,WAAW,kBAAkB;AAC9G,aAAO,EAAE,UAAU,MAAM;AAAA,IAC3B;AACA,WAAO,EAAE,UAAU,MAAM,OAAO,UAAU;AAAA,EAC5C;AACA,QAAM,cAAc,gBAAgB,WAAW,YAAY,UAAU;AACrE,MAAI,CAAC,YAAY,IAAI;AACnB,QAAI,OAAQ,OAAM,yBAAyB,UAAU,YAAY,MAAM,OAAO;AAC9E,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,MAAI,YAAY,UAAU,QAAW;AACnC,QAAI,OAAQ,OAAM,yBAAyB,UAAU,0CAA0C;AAC/F,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,SAAO,EAAE,UAAU,MAAM,OAAO,YAAY,MAAM;AACpD;AAsBO,SAAS,qBACd,QACA,SACA,kBACA,SACK;AACL,QAAM,SAAS,SAAS,SAAS;AACjC,MAAI,OAAO,WAAW,UAAU;AAG9B,UAAM,iBAAiB,OAAO,MAAM,mBAAmB;AAEvD,QAAI,gBAAgB;AAClB,YAAM,UAAU,iBAAiB,eAAe,CAAC,GAAG,SAAS,kBAAkB,MAAM;AACrF,aAAO,QAAQ,WAAW,QAAQ,QAAQ;AAAA,IAC5C;AAGA,WAAO,OAAO,QAAQ,oBAAoB,CAAC,OAAO,UAAU;AAC1D,YAAM,UAAU,iBAAiB,OAAO,SAAS,kBAAkB,MAAM;AACzE,aAAO,QAAQ,WAAW,OAAO,QAAQ,KAAK,IAAI;AAAA,IACpD,CAAC;AAAA,EACH;AAEA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO,OAAO,IAAI,CAAC,SAAS,qBAAqB,MAAM,SAAS,kBAAkB,OAAO,CAAC;AAAA,EAC5F;AAEA,MAAI,UAAU,OAAO,WAAW,UAAU;AACxC,UAAM,SAA8B,CAAC;AACrC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,aAAO,GAAG,IAAI,qBAAqB,OAAO,SAAS,kBAAkB,OAAO;AAAA,IAC9E;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,SAAS,0BACP,QACA,SACA,cACA,cACK;AACL,MAAI;AACF,WAAO,qBAAqB,QAAQ,QAAQ,iBAAiB,QAAQ,kBAAkB;AAAA,MACrF,MAAM,QAAQ;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAI,uBAAuB,MAAM,SAAS,cAAc,cAAc,EAAE,OAAO,MAAM,MAAM,CAAC;AAAA,IACpG;AACA,UAAM;AAAA,EACR;AACF;AAKA,SAAS,eAAe,KAAU,MAAmB;AACnD,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,QAAQ;AAEZ,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,OAAO,UAAU,YAAY,QAAQ,OAAO;AACvD,cAAQ,MAAM,IAAI;AAAA,IACpB,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKA,SAAS,iBACP,mBACA,oBACA,SACA,eACQ;AACR,QAAM,UAAU,oBAAoB,KAAK,IAAI,oBAAoB,OAAO;AACxE,SAAO,KAAK,IAAI,SAAS,iBAAiB,QAAQ;AACpD;AAKA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAUA,eAAe,mBACb,UACA,WACY;AACZ,MAAI;AACJ,QAAM,kBAAkB,IAAI,gBAAgB;AAE5C,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,gBAAY,WAAW,MAAM;AAC3B,sBAAgB,MAAM;AACtB,aAAO,IAAI,MAAM,oCAAoC,SAAS,IAAI,CAAC;AAAA,IACrE,GAAG,SAAS;AAAA,EACd,CAAC;AAED,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,gBAAgB,MAAM,GAAG,cAAc,CAAC;AAAA,EAC9E,UAAE;AACA,iBAAa,SAAU;AAAA,EACzB;AACF;AAEA,qBAAqB;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;",
+  "sourcesContent": ["/**\n * Workflows Module - Activity Executor Service\n *\n * Executes workflow activities (send email, call API, emit events, etc.)\n * - Supports multiple activity types\n * - Implements retry logic with exponential backoff\n * - Handles timeouts\n * - Variable interpolation from workflow context\n *\n * Functional API (no classes) following Open Mercato conventions.\n */\n\nimport { EntityManager } from '@mikro-orm/core'\nimport type { EntityManager as PostgreSqlEntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { WorkflowInstance } from '../data/entities'\nimport { createModuleQueue, Queue } from '@open-mercato/queue'\nimport { getRedisUrl } from '@open-mercato/shared/lib/redis/connection'\nimport {\n  safeOutboundFetch,\n  UnsafeOutboundUrlError,\n  type HostLookup,\n} from '@open-mercato/shared/lib/url-safety'\nimport { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'\nimport { isPrivateCrossProcessBroadcastEvent } from '@open-mercato/shared/modules/events'\nimport { hasAllFeatures } from '@open-mercato/shared/security/features'\nimport {\n  definitionDeclaresGrant,\n  resolveWorkflowDefinitionExecutionUserId,\n} from './definition-grant'\nimport {\n  callWebhookConfigSchema,\n  invokeAgentConfigSchema,\n  setVariableConfigSchema,\n} from '../data/activity-config-schemas'\nimport {\n  buildSetVariableContextPatch,\n  isSetVariableOutput,\n  splitAssignmentPath,\n  type SetVariableOutput,\n} from './set-variable'\nimport {\n  DRY_RUN_EVENT_TYPES,\n  WorkflowDryRunRefusalError,\n  isDryRunInstance,\n  isDryRunRefusal,\n} from './dry-run'\nimport {\n  applyTransforms,\n  parseInterpolationToken,\n  type WorkflowInterpolationMode,\n} from './interpolation-pipeline'\n\nexport { resolveDefinitionInterpolationMode, type WorkflowInterpolationMode } from './interpolation-pipeline'\nimport {\n  WorkflowActivityJob,\n  WorkflowActivityJobInvokeAgent,\n  WORKFLOW_ACTIVITIES_QUEUE_NAME,\n  WORKFLOW_INVOKE_AGENT_QUEUE_NAME,\n} from './activity-queue-types'\nimport './activity-registry-bootstrap'\nimport { bindActivityExecutor } from './activity-types'\nimport { getActivityType } from './activity-registry'\nimport { logWorkflowEvent } from './event-logger'\nimport { calculateWaitDelayMs, parseDuration } from './duration'\n\nexport { calculateWaitDelayMs } from './duration'\nimport { resolveActivityTimeoutMs } from './activityTimeoutFields'\nimport { getWorkflowSafeCommand } from './workflow-safe-commands'\nimport { isWorkflowCommandEnabled } from './workflow-command-enablement'\nimport { resolveWorkflowCommandPolicyForContainer } from './workflow-command-settings'\nimport { resolveAgentReview, toAgentDispositionReview } from './agent-review'\nimport type { AgentDispositionReview } from './agent-disposition-task'\n\nexport { isPrivateUrl } from '@open-mercato/shared/lib/network'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('workflows')\n\nfunction isAllowPrivateWorkflowWebhookUrlsEnabled(): boolean {\n  if (parseBooleanWithDefault(process.env.OM_WORKFLOWS_ALLOW_PRIVATE_URLS, false)) {\n    if (process.env.NODE_ENV === 'production') {\n      logger.warn('OM_WORKFLOWS_ALLOW_PRIVATE_URLS is set but ignored in production. SSRF protection remains enabled.', { component: 'CALL_WEBHOOK' })\n      return false\n    }\n\n    logger.warn('OM_WORKFLOWS_ALLOW_PRIVATE_URLS is enabled. SSRF protection is bypassed for workflow webhooks; use only in development.', { component: 'CALL_WEBHOOK' })\n    return true\n  }\n\n  if (parseBooleanWithDefault(process.env.WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS, false)) {\n    if (process.env.NODE_ENV === 'production') {\n      logger.warn('WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS is deprecated and ignored in production. Use OM_WORKFLOWS_ALLOW_PRIVATE_URLS for development only. SSRF protection remains enabled.', { component: 'CALL_WEBHOOK' })\n      return false\n    }\n\n    logger.warn('WORKFLOW_WEBHOOK_ALLOW_PRIVATE_URLS is deprecated. Use OM_WORKFLOWS_ALLOW_PRIVATE_URLS instead. SSRF protection is bypassed.', { component: 'CALL_WEBHOOK' })\n    return true\n  }\n\n  return false\n}\n\nconst DEFAULT_WORKFLOW_ENV_INTERPOLATION_ALLOWLIST = new Set(['APP_URL'])\nconst WORKFLOW_ENV_INTERPOLATION_ALLOWLIST_KEY = 'OM_WORKFLOWS_ENV_INTERPOLATION_ALLOWLIST'\n\nfunction getWorkflowEnvInterpolationAllowlist(): Set<string> {\n  const allowlist = new Set(DEFAULT_WORKFLOW_ENV_INTERPOLATION_ALLOWLIST)\n  const configuredKeys = process.env[WORKFLOW_ENV_INTERPOLATION_ALLOWLIST_KEY]\n  if (!configuredKeys) {\n    return allowlist\n  }\n\n  for (const key of configuredKeys.split(',')) {\n    const trimmedKey = key.trim()\n    if (trimmedKey) {\n      allowlist.add(trimmedKey)\n    }\n  }\n\n  return allowlist\n}\n\n// ============================================================================\n// Types and Interfaces\n// ============================================================================\n\nexport type ActivityType =\n  | 'SEND_EMAIL'\n  | 'CALL_API'\n  | 'EMIT_EVENT'\n  | 'UPDATE_ENTITY'\n  | 'CALL_WEBHOOK'\n  | 'EXECUTE_FUNCTION'\n  | 'WAIT'\n  | 'SET_VARIABLE'\n  | 'INVOKE_AGENT'\n\n/**\n * Signal name the INVOKE_AGENT step parks on when a proposal is routed to a\n * human. agent_orchestrator's proposal-dispose path emits\n * `agent_orchestrator.proposal.ready` and calls workflows `sendSignal` with this\n * name to resume the parked step.\n */\nexport const INVOKE_AGENT_SIGNAL_NAME = 'agent_orchestrator.proposal.ready'\n\n/**\n * Signal name a parked SUB_WORKFLOW step resumes on once its child instance\n * reaches a terminal state. `completeWorkflow` enqueues a resume job when the\n * child carries a parent linkage; the worker resumes the parent step via\n * `sendSignal` with this name.\n */\nexport const SUB_WORKFLOW_SIGNAL_NAME = 'workflows.sub_workflow.completed'\n\n/**\n * Small enqueue delay for the INVOKE_AGENT job so the workflow transaction that\n * parked the step commits before the worker picks the job up. The worker also\n * guards against the race (it requires the instance to be PAUSED at the step\n * before running the agent), so this only trims needless retries.\n */\nexport const INVOKE_AGENT_ENQUEUE_DELAY_MS = 1000\n\n/**\n * Marker carried on an activity result's output when the step must park and wait\n * for a signal (INVOKE_AGENT routed a proposal to a human). The step handler\n * inspects activity outputs for this marker and parks the instance accordingly.\n * researcher / auto_approved outcomes do NOT carry it and proceed inline.\n */\nexport type ActivityParkMarker = { signalName: string }\n\nexport function getActivityParkMarker(output: unknown): ActivityParkMarker | null {\n  if (output && typeof output === 'object' && '__park' in output) {\n    const park = (output as { __park?: unknown }).__park\n    if (park && typeof park === 'object' && typeof (park as { signalName?: unknown }).signalName === 'string') {\n      return { signalName: (park as { signalName: string }).signalName }\n    }\n  }\n  return null\n}\n\nexport interface ActivityDefinition {\n  activityId: string // Unique identifier for activity\n  activityName?: string // Optional, for debugging/logging\n  activityType: ActivityType\n  config: any\n  async?: boolean // Flag to execute activity asynchronously via queue\n  retryPolicy?: RetryPolicy\n  timeoutMs?: number\n  /**\n   * @deprecated Use `timeoutMs`. Legacy ISO 8601 duration string accepted by\n   * the definition schema before #4424; normalized by `resolveActivityTimeoutMs`.\n   */\n  timeout?: string\n  compensate?: boolean // Flag to execute compensation on failure\n}\n\nexport { resolveActivityTimeoutMs }\n\nexport interface RetryPolicy {\n  maxAttempts: number\n  initialIntervalMs: number\n  backoffCoefficient: number\n  maxIntervalMs: number\n}\n\nexport interface ActivityContext {\n  workflowInstance: WorkflowInstance\n  workflowContext: Record<string, any>\n  stepContext?: Record<string, any>\n  stepInstanceId?: string\n  // Set when the activity runs inside a parallel branch; carried on the queue\n  // payload so async resume targets the branch rather than the instance.\n  branchInstanceId?: string | null\n  transitionId?: string\n  userId?: string\n  // The owning definition's `interpolation` mode; absent means lenient.\n  // Async activities enforce strict mode at enqueue-time, so the worker-side\n  // context deliberately leaves this unset.\n  interpolationMode?: WorkflowInterpolationMode\n}\n\ntype RbacFeatureResolver = {\n  userHasAllFeatures: (\n    userId: string,\n    required: string[],\n    opts: { tenantId: string | null; organizationId: string | null }\n  ) => Promise<boolean>\n}\n\nasync function workflowUserHasAllFeatures(\n  container: AwilixContainer,\n  userId: string,\n  required: readonly string[],\n  tenantId: string | null,\n  organizationId: string | null\n): Promise<boolean> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacFeatureResolver | undefined\n    if (rbac?.userHasAllFeatures) {\n      return await rbac.userHasAllFeatures(userId, [...required], { tenantId, organizationId })\n    }\n  } catch {\n    // Fail closed below when the workflow executor cannot prove the actor's grants.\n  }\n  return false\n}\n\nexport interface ActivityExecutionResult {\n  activityId: string\n  activityName?: string\n  activityType: ActivityType\n  success: boolean\n  output?: any\n  error?: string\n  retryCount: number\n  executionTimeMs: number\n  async?: boolean // Marks activity as async (queued)\n  jobId?: string // Queue job ID for async activities\n  /**\n   * The activity was not attempted because a dry run cannot simulate its type\n   * (spec section 8.2). Callers MUST treat it as a stop, never as a failure:\n   * error routes and error directives describe what to do when an effector\n   * fails, and no effector ran.\n   */\n  dryRunRefused?: boolean\n}\n\nexport class ActivityExecutionError extends Error {\n  constructor(\n    message: string,\n    public activityType: ActivityType,\n    public activityName?: string,\n    public details?: any\n  ) {\n    super(message)\n    this.name = 'ActivityExecutionError'\n  }\n}\n\n/**\n * Thrown by `interpolateVariables` in strict mode when a token cannot be\n * resolved (unresolved context path, env-allowlist miss, unknown workflow.*\n * key, failed or unparseable transform pipeline). Activity call sites rethrow\n * it as `ActivityExecutionError` so it flows through the normal retry/failure\n * machinery.\n */\nexport class WorkflowInterpolationError extends Error {\n  constructor(\n    message: string,\n    public token: string\n  ) {\n    super(message)\n    this.name = 'WorkflowInterpolationError'\n  }\n}\n\n// ============================================================================\n// Queue Integration for Async Activities\n// ============================================================================\n\nlet activityQueue: Queue<WorkflowActivityJob> | null = null\nlet invokeAgentQueue: Queue<WorkflowActivityJob> | null = null\n\n/**\n * Get or create the activity queue (lazy initialization)\n */\nfunction getActivityQueue(): Queue<WorkflowActivityJob> {\n  if (!activityQueue) {\n    activityQueue = createModuleQueue<WorkflowActivityJob>(\n      WORKFLOW_ACTIVITIES_QUEUE_NAME,\n      { concurrency: parseInt(process.env.WORKFLOW_WORKER_CONCURRENCY || '5') },\n    )\n  }\n\n  return activityQueue\n}\n\n/**\n * Get or create the dedicated invoke-agent queue (lazy initialization).\n *\n * Minute-long agent runs get their own queue so they never starve the fast\n * activities sharing 'workflow-activities'. Consumer-side concurrency is\n * governed by the workflow-invoke-agent worker's metadata.\n */\nfunction getInvokeAgentQueue(): Queue<WorkflowActivityJob> {\n  if (!invokeAgentQueue) {\n    invokeAgentQueue = createModuleQueue<WorkflowActivityJob>(\n      WORKFLOW_INVOKE_AGENT_QUEUE_NAME,\n      { concurrency: parseInt(process.env.WORKERS_WORKFLOW_INVOKE_AGENT_CONCURRENCY || '5', 10) },\n    )\n  }\n\n  return invokeAgentQueue\n}\n\n/**\n * Enqueue an activity for background execution\n *\n * @param em - Entity manager\n * @param activity - Activity definition\n * @param context - Execution context\n * @returns Job ID\n */\nexport async function enqueueActivity(\n  em: EntityManager,\n  activity: ActivityDefinition,\n  context: ActivityContext\n): Promise<string> {\n  const { workflowInstance, workflowContext, stepContext, transitionId, stepInstanceId, branchInstanceId } =\n    context\n\n  const registryEntry = getActivityType(activity.activityType)\n  if (registryEntry && registryEntry.async.capable === false) {\n    throw new ActivityExecutionError(\n      `[internal] Activity type ${activity.activityType} cannot run asynchronously (${registryEntry.async.reason})`,\n      activity.activityType,\n      activity.activityName\n    )\n  }\n\n  // Interpolate config variables NOW (before queuing) \u2014 strict mode is\n  // enforced here, at enqueue-time, before the job serializes frozen config.\n  const interpolatedConfig = interpolateActivityConfig(\n    activity.config,\n    context,\n    activity.activityType,\n    activity.activityName\n  )\n\n  // Create job payload\n  const job: WorkflowActivityJob = {\n    workflowInstanceId: workflowInstance.id,\n    stepInstanceId,\n    branchInstanceId: branchInstanceId ?? undefined,\n    transitionId,\n    activityId: activity.activityId,\n    activityName: activity.activityName || activity.activityType,\n    activityType: activity.activityType,\n    activityConfig: interpolatedConfig,\n    workflowContext,\n    stepContext,\n    retryPolicy: activity.retryPolicy,\n    timeoutMs: activity.timeoutMs,\n    tenantId: workflowInstance.tenantId,\n    organizationId: workflowInstance.organizationId,\n    userId: context.userId,\n  }\n\n  // Enqueue to queue (entries with enqueueDelayMs, e.g. WAIT, use delayMs for the actual delay)\n  const queue = getActivityQueue()\n  const registryDelayMs = registryEntry?.enqueueDelayMs\n    ? registryEntry.enqueueDelayMs(interpolatedConfig)\n    : null\n  const enqueueOptions = registryDelayMs !== null ? { delayMs: registryDelayMs } : undefined\n  const jobId = await queue.enqueue(job, enqueueOptions)\n\n  // Log event\n  await logWorkflowEvent(em, {\n    workflowInstanceId: workflowInstance.id,\n    stepInstanceId,\n    eventType: 'ACTIVITY_QUEUED',\n    eventData: {\n      activityId: activity.activityId,\n      activityName: activity.activityName,\n      activityType: activity.activityType,\n      async: true,\n      jobId,\n    },\n    tenantId: workflowInstance.tenantId,\n    organizationId: workflowInstance.organizationId,\n  })\n\n  return jobId\n}\n\n/**\n * Enqueue a delayed timer job for a WAIT_FOR_TIMER step.\n *\n * The activity worker handles `kind: 'timer'` jobs by calling\n * `timerHandler.fireTimer`, which resumes the paused workflow instance.\n */\nexport async function enqueueTimerJob(params: {\n  workflowInstanceId: string\n  stepInstanceId: string\n  branchInstanceId?: string | null\n  tenantId: string\n  organizationId: string\n  userId?: string\n  fireAt: string\n  delayMs: number\n}): Promise<string> {\n  const { workflowInstanceId, stepInstanceId, branchInstanceId, tenantId, organizationId, userId, fireAt, delayMs } =\n    params\n\n  const queue = getActivityQueue()\n  const jobId = await queue.enqueue(\n    {\n      kind: 'timer',\n      workflowInstanceId,\n      stepInstanceId,\n      branchInstanceId: branchInstanceId ?? undefined,\n      tenantId,\n      organizationId,\n      userId,\n      fireAt,\n    },\n    { delayMs: delayMs > 0 ? delayMs : undefined }\n  )\n\n  return jobId\n}\n\n/**\n * Enqueue a delayed SLA job for a USER_TASK (one reminder offset, or the\n * deadline itself).\n *\n * The activity worker handles `kind: 'task_sla'` jobs by calling\n * `taskSla.runTaskSlaJob`. `deadlineAt` is absolute and carried on the payload\n * rather than recomputed at run time, so a queue running behind can never\n * extend the configured deadline \u2014 the same guarantee the WAIT_FOR_CONDITION\n * backstop gives.\n */\nexport async function enqueueTaskSlaJob(params: {\n  workflowInstanceId: string\n  stepInstanceId: string\n  branchInstanceId?: string | null\n  userTaskId: string\n  phase: 'reminder' | 'breach'\n  deadlineAt: string\n  fireAt: string\n  delayMs: number\n  tenantId: string\n  organizationId: string\n  userId?: string\n}): Promise<string> {\n  const {\n    workflowInstanceId,\n    stepInstanceId,\n    branchInstanceId,\n    userTaskId,\n    phase,\n    deadlineAt,\n    fireAt,\n    delayMs,\n    tenantId,\n    organizationId,\n    userId,\n  } = params\n\n  const queue = getActivityQueue()\n  return await queue.enqueue(\n    {\n      kind: 'task_sla',\n      workflowInstanceId,\n      stepInstanceId,\n      branchInstanceId: branchInstanceId ?? undefined,\n      userTaskId,\n      phase,\n      deadlineAt,\n      fireAt,\n      tenantId,\n      organizationId,\n      userId,\n    },\n    { delayMs: delayMs > 0 ? delayMs : undefined }\n  )\n}\n\n/**\n * Enqueue a delayed poll job for a WAIT_FOR_CONDITION step.\n *\n * The activity worker handles `kind: 'condition'` jobs by calling\n * `conditionHandler.evaluateWaitCondition`. This job is the durability\n * backstop behind the event-driven wake: `deadlineAt` travels unchanged across\n * every re-enqueue so the timeout stays anchored to the original step entry.\n */\nexport async function enqueueConditionCheckJob(params: {\n  workflowInstanceId: string\n  stepInstanceId: string\n  branchInstanceId?: string | null\n  tenantId: string\n  organizationId: string\n  userId?: string\n  deadlineAt: string\n  attempt: number\n  delayMs: number\n}): Promise<string> {\n  const {\n    workflowInstanceId,\n    stepInstanceId,\n    branchInstanceId,\n    tenantId,\n    organizationId,\n    userId,\n    deadlineAt,\n    attempt,\n    delayMs,\n  } = params\n\n  const queue = getActivityQueue()\n  const jobId = await queue.enqueue(\n    {\n      kind: 'condition',\n      workflowInstanceId,\n      stepInstanceId,\n      branchInstanceId: branchInstanceId ?? undefined,\n      tenantId,\n      organizationId,\n      userId,\n      deadlineAt,\n      attempt,\n    },\n    { delayMs: delayMs > 0 ? delayMs : undefined }\n  )\n\n  return jobId\n}\n\n// ============================================================================\n// Main Activity Execution Functions\n// ============================================================================\n\n/**\n * Execute a single activity with retry logic and timeout\n *\n * @param em - Entity manager\n * @param container - DI container\n * @param activity - Activity definition\n * @param context - Execution context\n * @returns Execution result\n */\nexport async function executeActivity(\n  em: EntityManager,\n  container: AwilixContainer,\n  activity: ActivityDefinition,\n  context: ActivityContext\n): Promise<ActivityExecutionResult> {\n  const retryPolicy = activity.retryPolicy || {\n    maxAttempts: 1,\n    initialIntervalMs: 0,\n    backoffCoefficient: 1,\n    maxIntervalMs: 0,\n  }\n\n  let lastError: any\n  let retryCount = 0\n\n  for (let attempt = 0; attempt < retryPolicy.maxAttempts; attempt++) {\n    try {\n      const startTime = Date.now()\n\n      // Execute with timeout if specified (timeoutMs, or a legacy ISO 8601\n      // `timeout` string normalized to ms \u2014 see resolveActivityTimeoutMs).\n      const timeoutMs = resolveActivityTimeoutMs(activity)\n      const result = timeoutMs\n        ? await executeWithTimeout(\n            (signal) => executeActivityByType(em, container, activity, context, signal),\n            timeoutMs\n          )\n        : await executeActivityByType(em, container, activity, context)\n\n      const executionTimeMs = Date.now() - startTime\n\n      return {\n        activityId: activity.activityId,\n        activityName: activity.activityName,\n        activityType: activity.activityType,\n        success: true,\n        output: result,\n        retryCount: attempt,\n        executionTimeMs,\n        async: activity.async || false,\n      }\n    } catch (error) {\n      lastError = error\n      retryCount = attempt + 1\n\n      // A dry-run refusal is not a failure \u2014 nothing was attempted \u2014 so retrying\n      // it would only re-log the same refusal N times before reaching the same\n      // answer.\n      if (isDryRunRefusal(error)) break\n\n      // Log activity retry attempt with context\n      if (attempt < retryPolicy.maxAttempts - 1) {\n        logger.error('Activity failed; will retry', {\n          activityId: activity.activityId,\n          activityType: activity.activityType,\n          attempt: attempt + 1,\n          maxAttempts: retryPolicy.maxAttempts,\n          instanceId: context.workflowInstance.id,\n          err: error,\n        })\n      }\n\n      // If not the last attempt, apply backoff and retry\n      if (attempt < retryPolicy.maxAttempts - 1) {\n        const backoff = calculateBackoff(\n          retryPolicy.initialIntervalMs,\n          retryPolicy.backoffCoefficient,\n          attempt,\n          retryPolicy.maxIntervalMs\n        )\n\n        await sleep(backoff)\n      }\n    }\n  }\n\n  // All retries exhausted\n  const errorMessage = lastError instanceof Error ? lastError.message : String(lastError)\n  if (isDryRunRefusal(lastError)) {\n    return {\n      activityId: activity.activityId,\n      activityName: activity.activityName,\n      activityType: activity.activityType,\n      success: false,\n      dryRunRefused: true,\n      error: `Dry run stopped: activity type ${lastError.activityType} cannot be simulated (${lastError.reason})`,\n      retryCount: 0,\n      executionTimeMs: 0,\n      async: activity.async || false,\n    }\n  }\n  logger.error('Activity failed after all attempts', {\n    activityId: activity.activityId,\n    activityType: activity.activityType,\n    attempts: retryCount,\n    instanceId: context.workflowInstance.id,\n    err: lastError,\n  })\n\n  return {\n    activityId: activity.activityId,\n    activityName: activity.activityName,\n    activityType: activity.activityType,\n    success: false,\n    error: `Activity failed after ${retryCount} attempts: ${errorMessage}`,\n    retryCount,\n    executionTimeMs: 0,\n    async: activity.async || false,\n  }\n}\n\n/**\n * Execute multiple activities in sequence\n * Supports both synchronous and asynchronous (queued) execution\n *\n * @param em - Entity manager\n * @param container - DI container\n * @param activities - Array of activity definitions\n * @param context - Execution context\n * @returns Array of execution results\n */\nexport async function executeActivities(\n  em: EntityManager,\n  container: AwilixContainer,\n  activities: ActivityDefinition[],\n  context: ActivityContext\n): Promise<ActivityExecutionResult[]> {\n  const results: ActivityExecutionResult[] = []\n\n  // A dry run never enqueues. The queue job would carry no `isDryRun` of its\n  // own, so a worker picking it up would execute the real effector on its own\n  // connection \u2014 the isolation would leak out of the request that opted in.\n  // Mocks are pure and synchronous, so running them inline loses nothing.\n  const forceSynchronous = isDryRunInstance(context.workflowInstance)\n\n  for (let i = 0; i < activities.length; i++) {\n    const activity = activities[i]\n\n    // Check if activity should run async\n    if (activity.async && !forceSynchronous) {\n      // Enqueue for background execution\n      const jobId = await enqueueActivity(em, activity, context)\n\n      results.push({\n        activityId: activity.activityId,\n        activityName: activity.activityName,\n        activityType: activity.activityType,\n        success: true, // Queued successfully\n        async: true,\n        jobId,\n        retryCount: 0,\n        executionTimeMs: 0,\n      })\n    } else {\n      // Execute synchronously (existing logic)\n      const executed = await executeActivity(em, container, activity, context)\n      // `executeActivity` echoes the AUTHORED `async` flag, which is what the\n      // transition handler reads to decide whether to park the token in\n      // WAITING_FOR_ACTIVITIES. A dry run that ran an authored-async activity\n      // inline must therefore correct the flag, or the run would park waiting\n      // for a queue job that was deliberately never enqueued \u2014 a deadlock, and\n      // the step handler would also misclassify a refusal as \"still pending\"\n      // instead of a failure.\n      const result = forceSynchronous && activity.async\n        ? { ...executed, async: false }\n        : executed\n      results.push(result)\n\n      // Stop execution if activity fails (fail-fast)\n      if (!result.success) {\n        break\n      }\n\n      // Update workflow context with activity output. SET_VARIABLE outputs\n      // land at their assignment paths in top-level context; every other\n      // output merges under the activity name/type key.\n      if (result.output && typeof result.output === 'object') {\n        if (activity.activityType === 'SET_VARIABLE' && isSetVariableOutput(result.output)) {\n          context.workflowContext = {\n            ...context.workflowContext,\n            ...buildSetVariableContextPatch(context.workflowContext, result.output.assignments),\n          }\n        } else {\n          const key = activity.activityName || activity.activityType\n          context.workflowContext = {\n            ...context.workflowContext,\n            [key]: result.output,\n          }\n        }\n      }\n    }\n  }\n\n  return results\n}\n\n// ============================================================================\n// Activity Type Handlers\n// ============================================================================\n\n/**\n * Execute activity based on its type\n */\nasync function executeActivityByType(\n  em: EntityManager,\n  container: AwilixContainer,\n  activity: ActivityDefinition,\n  context: ActivityContext,\n  signal?: AbortSignal\n): Promise<any> {\n  // Interpolate config variables from context (including workflow metadata)\n  const interpolatedConfig = interpolateActivityConfig(\n    activity.config,\n    context,\n    activity.activityType,\n    activity.activityName\n  )\n\n  const entry = getActivityType(activity.activityType)\n  if (!entry) {\n    throw new ActivityExecutionError(\n      `Unknown activity type: ${activity.activityType}`,\n      activity.activityType,\n      activity.activityName\n    )\n  }\n\n  // Dry run (spec section 8.2): the ONE place `entry.execute` is reached, so it\n  // is the one place the swap has to happen. Everything side-effecting in the\n  // engine ends up here \u2014 the command bus, the event bus, the mailer, the\n  // webhook fetch and the agent bridge \u2014 which is what makes \"no effector runs\"\n  // a property of a single branch rather than a checklist.\n  if (isDryRunInstance(context.workflowInstance)) {\n    if (entry.mock === 'refuse' || entry.mock === undefined) {\n      const refusal = new WorkflowDryRunRefusalError(\n        activity.activityType,\n        entry.mock === 'refuse' ? 'refused' : 'noMock',\n        activity.activityName,\n      )\n      await logWorkflowEvent(em, {\n        workflowInstanceId: context.workflowInstance.id,\n        stepInstanceId: context.stepInstanceId,\n        eventType: DRY_RUN_EVENT_TYPES.activityRefused,\n        eventData: {\n          activityId: activity.activityId,\n          activityName: activity.activityName,\n          activityType: activity.activityType,\n          reason: refusal.reason,\n        },\n        tenantId: context.workflowInstance.tenantId,\n        organizationId: context.workflowInstance.organizationId,\n      })\n      throw refusal\n    }\n\n    const simulated = entry.mock(interpolatedConfig, context)\n    await logWorkflowEvent(em, {\n      workflowInstanceId: context.workflowInstance.id,\n      stepInstanceId: context.stepInstanceId,\n      eventType: DRY_RUN_EVENT_TYPES.activitySimulated,\n      eventData: {\n        activityId: activity.activityId,\n        activityName: activity.activityName,\n        activityType: activity.activityType,\n        output: simulated ?? null,\n      },\n      tenantId: context.workflowInstance.tenantId,\n      organizationId: context.workflowInstance.organizationId,\n    })\n    return simulated\n  }\n\n  // `signal` MUST reach the registry entry: CALL_API / CALL_WEBHOOK thread it\n  // into fetch, and without it a per-activity timeout rejects the promise while\n  // the HTTP request stays in flight \u2014 the phantom-execution bug from #4918.\n  return await entry.execute(interpolatedConfig, context, {\n    em: em as PostgreSqlEntityManager,\n    container,\n    signal,\n  })\n}\n\n/**\n * SEND_EMAIL activity handler\n *\n * Sends via the DI-registered emailService when available; without one it\n * reports an honest stub result ({ sent: false, simulated: true, reason: 'no-email-service' }).\n * A real send() failure propagates so the activity retry loop handles it.\n * When a timeout AbortSignal is provided it is forwarded on the send payload and\n * the await is raced against abort (#5148).\n */\nexport async function executeSendEmail(\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer,\n  signal?: AbortSignal\n): Promise<any> {\n  const { to, subject, template, templateData, body } = config\n\n  if (!to || !subject) {\n    throw new Error('SEND_EMAIL requires \"to\" and \"subject\" fields')\n  }\n\n  throwIfAborted(signal)\n\n  logger.info('Send email activity invoked', { component: 'SEND_EMAIL', subject })\n\n  let emailService: { send: (input: unknown) => Promise<unknown> | unknown } | undefined\n  try {\n    emailService = container.resolve<{ send: (input: unknown) => Promise<unknown> | unknown }>('emailService')\n  } catch {\n    emailService = undefined\n  }\n\n  if (emailService && typeof emailService.send === 'function') {\n    await raceAbortable(\n      Promise.resolve(\n        emailService.send({\n          to,\n          subject,\n          template,\n          templateData,\n          body,\n          signal,\n        })\n      ),\n      signal\n    )\n    throwIfAborted(signal)\n    return { sent: true, to, subject, via: 'emailService' }\n  }\n\n  logger.warn('SEND_EMAIL has no registered email service; email was not sent', { component: 'SEND_EMAIL', subject })\n  return { sent: false, simulated: true, to, subject, via: 'console', reason: 'no-email-service' }\n}\n\n/**\n * EMIT_EVENT activity handler\n *\n * Publishes a domain event to the event bus.\n * Honours an activity-timeout AbortSignal by refusing to dispatch after abort\n * (throwIfAborted guard) and by racing the await against the signal via\n * raceAbortable (#5148). The event bus does not declare a signal parameter, so\n * an emit that has already begun cannot be cancelled \u2014 same contract as UPDATE_ENTITY.\n */\nexport async function executeEmitEvent(\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer,\n  signal?: AbortSignal\n): Promise<any> {\n  const { eventName, payload } = config\n\n  if (!eventName) {\n    throw new Error('EMIT_EVENT requires \"eventName\" field')\n  }\n\n  // Workflow definitions are tenant-managed input. Private cross-process\n  // events coordinate trusted server state (for example closing an in-memory\n  // collaboration room), so allowing a workflow to name one would turn a\n  // regular event activity into a cross-process invalidation primitive.\n  if (isPrivateCrossProcessBroadcastEvent(eventName)) {\n    throw new Error(`EMIT_EVENT cannot emit private cross-process event \"${eventName}\"`)\n  }\n\n  // Emissions are fire-and-forget and no subscriber validates the payload shape,\n  // so an unresolved `{{context.x}}` here is even quieter than on the command\n  // path \u2014 it ships the literal template to every consumer. Fail loudly instead.\n  const unresolvedPayloadKeys = findUnresolvedTemplateKeys(payload)\n  if (unresolvedPayloadKeys.length > 0) {\n    throw new Error(\n      `EMIT_EVENT payload contains unresolved template variables for: ${unresolvedPayloadKeys.join(', ')}. ` +\n        `Check that the workflow context provides these keys.`\n    )\n  }\n\n  throwIfAborted(signal)\n\n  // Get event bus from container\n  const eventBus = container.resolve<{ emitEvent: (event: string, payload: unknown, options?: unknown) => Promise<unknown> | unknown }>('eventBus')\n\n  if (!eventBus || typeof eventBus.emitEvent !== 'function') {\n    throw new Error('Event bus not available in container')\n  }\n\n  // Publish event with workflow metadata\n  const enrichedPayload = {\n    ...payload,\n    _workflow: {\n      workflowInstanceId: context.workflowInstance.id,\n      workflowId: context.workflowInstance.workflowId,\n      tenantId: context.workflowInstance.tenantId,\n      organizationId: context.workflowInstance.organizationId,\n    },\n  }\n\n  await raceAbortable(\n    Promise.resolve(\n      eventBus.emitEvent(eventName, enrichedPayload, {\n        tenantId: context.workflowInstance.tenantId,\n        organizationId: context.workflowInstance.organizationId,\n      })\n    ),\n    signal\n  )\n  throwIfAborted(signal)\n\n  return { emitted: true, eventName, payload: enrichedPayload }\n}\n\nconst UNRESOLVED_TEMPLATE_PATTERN = /\\{\\{[^}]+\\}\\}/\n\nfunction findUnresolvedTemplateKeys(value: unknown, path = ''): string[] {\n  if (typeof value === 'string') {\n    return UNRESOLVED_TEMPLATE_PATTERN.test(value) ? [path] : []\n  }\n  if (Array.isArray(value)) {\n    return value.flatMap((item, index) => findUnresolvedTemplateKeys(item, `${path}[${index}]`))\n  }\n  if (value && typeof value === 'object') {\n    return Object.entries(value).flatMap(([key, nested]) =>\n      findUnresolvedTemplateKeys(nested, path ? `${path}.${key}` : key)\n    )\n  }\n  return []\n}\n\n/**\n * UPDATE_ENTITY activity handler\n *\n * Updates an entity via CommandBus for proper audit logging, undo support, and side effects.\n *\n * Config format:\n * ```json\n * {\n *   \"commandId\": \"sales.documents.update\",\n *   \"input\": {\n *     \"id\": \"{{context.orderId}}\",\n *     \"statusEntryId\": \"{{context.approvedStatusId}}\"\n *   }\n * }\n * ```\n *\n * Alternative format with statusValue (auto-resolves to statusEntryId):\n * ```json\n * {\n *   \"commandId\": \"sales.orders.update\",\n *   \"statusDictionary\": \"sales.order_status\",\n *   \"input\": {\n *     \"id\": \"{{context.orderId}}\",\n *     \"statusValue\": \"pending_approval\"\n *   }\n * }\n * ```\n *\n * Every `{{...}}` reference in `input` must resolve against the workflow context \u2014\n * an unresolved reference is rejected rather than forwarded to the command bus.\n */\nexport async function executeUpdateEntity(\n  em: EntityManager,\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer,\n  signal?: AbortSignal\n): Promise<any> {\n  const { commandId, input, statusDictionary } = config\n\n  if (!commandId) {\n    throw new Error('UPDATE_ENTITY requires \"commandId\" field (e.g., \"sales.documents.update\")')\n  }\n\n  // Gate 1 \u2014 the CODE declares this command possible.\n  const workflowSafeCommand = getWorkflowSafeCommand(commandId)\n  if (!workflowSafeCommand) {\n    throw new Error('UPDATE_ENTITY command is not allowed')\n  }\n\n  // Gate 2 \u2014 this TENANT switched it on. A tenant that never saved the setting\n  // resolves to the grandfathered set, so this is byte-identical to the\n  // pre-setting behaviour for every existing tenant.\n  const commandPolicy = await resolveWorkflowCommandPolicyForContainer(\n    container,\n    context.workflowInstance.tenantId,\n  )\n  throwIfAborted(signal)\n  if (!isWorkflowCommandEnabled(workflowSafeCommand, commandPolicy)) {\n    throw new Error('UPDATE_ENTITY command is not enabled for this tenant')\n  }\n\n  if (!input || typeof input !== 'object') {\n    throw new Error('UPDATE_ENTITY requires \"input\" object with entity data')\n  }\n\n  const actorUserId = typeof context.userId === 'string' ? context.userId.trim() : ''\n  if (!actorUserId) {\n    throw new Error('UPDATE_ENTITY requires an authenticated workflow user')\n  }\n\n  const authorized = await workflowUserHasAllFeatures(\n    container,\n    actorUserId,\n    workflowSafeCommand.requiredFeatures,\n    context.workflowInstance.tenantId,\n    context.workflowInstance.organizationId\n  )\n  throwIfAborted(signal)\n  if (!authorized) {\n    throw new Error('UPDATE_ENTITY command is not authorized')\n  }\n\n  // Resolve CommandBus from container\n  const commandBus = container.resolve('commandBus') as any\n\n  if (!commandBus || typeof commandBus.execute !== 'function') {\n    throw new Error('CommandBus not available in container')\n  }\n\n  const unresolvedKeys = findUnresolvedTemplateKeys(input)\n  if (unresolvedKeys.length > 0) {\n    throw new Error(\n      `UPDATE_ENTITY input contains unresolved template variables for: ${unresolvedKeys.join(', ')}. ` +\n        `Check that the workflow context provides these keys.`\n    )\n  }\n\n  // Prepare final input, resolving statusValue if provided\n  let finalInput = { ...input }\n\n  // If statusValue is provided with a statusDictionary, resolve it to statusEntryId\n  if (finalInput.statusValue && statusDictionary) {\n    const statusEntryId = await resolveDictionaryEntryId(\n      em,\n      statusDictionary,\n      finalInput.statusValue,\n      context.workflowInstance.tenantId,\n      context.workflowInstance.organizationId\n    )\n    throwIfAborted(signal)\n    if (statusEntryId) {\n      finalInput.statusEntryId = statusEntryId\n    }\n    delete finalInput.statusValue\n  }\n\n  // Build synthetic CommandRuntimeContext for workflow execution\n  const ctx = {\n    container,\n    auth: {\n      sub: actorUserId,\n      tenantId: context.workflowInstance.tenantId,\n      orgId: context.workflowInstance.organizationId,\n      isSuperAdmin: false,\n    },\n    organizationScope: null,\n    selectedOrganizationId: context.workflowInstance.organizationId,\n    organizationIds: context.workflowInstance.organizationId\n      ? [context.workflowInstance.organizationId]\n      : null,\n  }\n\n  // Execute the command. A timeout AbortSignal refuses a start (throwIfAborted\n  // guard) and races the await via raceAbortable (#5148). CommandBus.execute\n  // does not accept a signal, so a write that has already begun cannot be rolled back.\n  throwIfAborted(signal)\n  const { result, logEntry } = await raceAbortable(\n    Promise.resolve(\n      commandBus.execute(commandId, {\n        input: finalInput,\n        ctx,\n      })\n    ),\n    signal\n  )\n  throwIfAborted(signal)\n\n  return {\n    executed: true,\n    commandId,\n    result,\n    logEntryId: logEntry?.id,\n  }\n}\n\n/**\n * Helper to resolve dictionary entry ID by value\n */\nasync function resolveDictionaryEntryId(\n  em: EntityManager,\n  dictionaryKey: string,\n  value: string,\n  tenantId: string,\n  organizationId: string\n): Promise<string | null> {\n  try {\n    // Import here to avoid circular dependencies\n    const { Dictionary, DictionaryEntry } = await import('@open-mercato/core/modules/dictionaries/data/entities')\n\n    // Find the dictionary\n    const dictionary = await em.findOne(Dictionary, {\n      key: dictionaryKey,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    })\n\n    if (!dictionary) {\n      logger.warn('Dictionary not found', { component: 'UPDATE_ENTITY', dictionaryKey })\n      return null\n    }\n\n    // Find the entry by normalized value\n    const normalizedValue = value.toLowerCase().trim()\n    const entry = await em.findOne(DictionaryEntry, {\n      dictionary: dictionary.id,\n      tenantId,\n      organizationId,\n      normalizedValue,\n    })\n\n    if (!entry) {\n      logger.warn('Dictionary entry not found', { component: 'UPDATE_ENTITY', dictionaryKey, value })\n      return null\n    }\n\n    return entry.id\n  } catch (error) {\n    logger.error('Error resolving dictionary entry', { component: 'UPDATE_ENTITY', err: error })\n    return null\n  }\n}\n\n/**\n * CALL_WEBHOOK activity handler\n *\n * Makes HTTP request to an external URL. Applies shared SSRF guard\n * (protocol / credentials / blocked host / private IP literal / DNS rebinding)\n * before issuing the request and rejects any 3xx redirect rather than following.\n */\nexport type CallWebhookDeps = {\n  lookupHost?: HostLookup\n  allowPrivate?: boolean\n  fetchImpl?: typeof fetch\n  signal?: AbortSignal\n}\n\nexport async function executeCallWebhook(\n  config: unknown,\n  context: ActivityContext,\n  deps: CallWebhookDeps = {}\n): Promise<any> {\n  const parsed = callWebhookConfigSchema.safeParse(config)\n  if (!parsed.success) {\n    const issues = parsed.error.issues\n      .map((issue) => `${issue.path.join('.') || 'config'}: ${issue.message}`)\n      .join('; ')\n    throw new Error(`CALL_WEBHOOK config invalid: ${issues}`)\n  }\n  const { url, method, headers: rawHeaders, body } = parsed.data\n  const headers = rawHeaders ?? {}\n\n  const allowPrivate = deps.allowPrivate ?? isAllowPrivateWorkflowWebhookUrlsEnabled()\n\n  let response: Response\n  try {\n    response = await safeOutboundFetch(\n      url,\n      {\n        method,\n        headers: {\n          'Content-Type': 'application/json',\n          ...headers,\n        },\n        body: body !== undefined && body !== null ? JSON.stringify(body) : undefined,\n        redirect: 'manual',\n        signal: deps.signal,\n      },\n      {\n        subject: 'Workflow webhook URL',\n        allowPrivate,\n        lookupHost: deps.lookupHost,\n        fetchImpl: deps.fetchImpl,\n      },\n    )\n  } catch (error) {\n    if (error instanceof UnsafeOutboundUrlError) {\n      throw new Error(\n        `CALL_WEBHOOK rejected unsafe URL (reason=${error.reason}): ${error.message}`\n      )\n    }\n    throw error\n  }\n\n  if (response.status >= 300 && response.status < 400) {\n    const location = response.headers.get('location')\n    throw new Error(\n      `CALL_WEBHOOK refused to follow redirect ${response.status} to ${\n        location ?? '(no Location header)'\n      }`\n    )\n  }\n\n  // Parse response\n  let result: any\n  const contentType = response.headers.get('content-type')\n\n  if (contentType && contentType.includes('application/json')) {\n    result = await response.json()\n  } else {\n    result = await response.text()\n  }\n\n  // Check for HTTP errors\n  if (!response.ok) {\n    throw new Error(\n      `Webhook request failed with status ${response.status}: ${JSON.stringify(result)}`\n    )\n  }\n\n  return {\n    status: response.status,\n    statusText: response.statusText,\n    result,\n  }\n}\n\n/**\n * EXECUTE_FUNCTION activity handler\n *\n * Calls a registered function from DI container.\n * Forwards the activity-timeout AbortSignal as the third argument so registered\n * functions can cancel cooperative work (#5148).\n */\nexport async function executeFunction(\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer,\n  signal?: AbortSignal\n): Promise<any> {\n  const { functionName, args = {} } = config\n\n  if (!functionName) {\n    throw new Error('EXECUTE_FUNCTION requires \"functionName\" field')\n  }\n\n  throwIfAborted(signal)\n\n  // Look up function in container\n  const fnKey = `workflowFunction:${functionName}`\n\n  try {\n    const fn = container.resolve(fnKey)\n\n    if (typeof fn !== 'function') {\n      throw new Error(`Registered workflow function \"${functionName}\" is not a function`)\n    }\n\n    // Call function with args, context, and optional abort signal (additive \u2014\n    // existing two-arg functions ignore the third parameter).\n    const result = await raceAbortable(\n      Promise.resolve(fn(args, context, signal)),\n      signal\n    )\n    throwIfAborted(signal)\n\n    return { executed: true, functionName, result }\n  } catch (error) {\n    if (error instanceof Error && error.message.includes('not registered')) {\n      throw new Error(\n        `Workflow function \"${functionName}\" not registered in DI container (key: ${fnKey})`\n      )\n    }\n    throw error\n  }\n}\n\n/**\n * WAIT activity handler\n *\n * Delays workflow execution for a configured duration or until a specific datetime.\n * - `duration`: relative delay (e.g. \"PT5M\", \"1h\", \"30s\")\n * - `until`: absolute datetime (e.g. \"2026-04-15T10:00:00Z\")\n * - Sync mode: blocks via sleep (suitable for short delays)\n * - Async mode: delay is handled by the queue's delayMs option;\n *   this handler returns immediately when called from the worker\n */\nexport async function executeWait(config: any): Promise<any> {\n  const durationMs = calculateWaitDelayMs(config)\n\n  // In sync mode, actually sleep for the duration\n  // In async mode (called from worker), the delay already happened via queue scheduling\n  await sleep(durationMs)\n\n  return { waited: true, durationMs }\n}\n\n/**\n * SET_VARIABLE activity handler\n *\n * Validates the (already interpolated) assignments and echoes them back as\n * `{ assignments }`. The sync merge points detect this output shape via\n * `isSetVariableOutput` and apply each assignment at its dot path in\n * top-level workflow context (see lib/set-variable.ts) instead of\n * namespacing the output under the activity name/type key.\n */\nexport async function executeSetVariable(\n  config: unknown,\n  context: ActivityContext\n): Promise<SetVariableOutput> {\n  const parsed = setVariableConfigSchema.safeParse(config)\n  if (!parsed.success) {\n    const issues = parsed.error.issues\n      .map((issue) => `${issue.path.join('.') || 'config'}: ${issue.message}`)\n      .join('; ')\n    throw new Error(`SET_VARIABLE config invalid: ${issues}`)\n  }\n\n  for (const assignment of parsed.data.assignments) {\n    const segments = splitAssignmentPath(assignment.path)\n    if (segments === null) {\n      throw new Error(\n        `SET_VARIABLE assignment path contains a forbidden segment (__proto__, constructor, prototype): \"${assignment.path}\"`\n      )\n    }\n    if (segments.length === 0) {\n      throw new Error(`SET_VARIABLE assignment path is blank: \"${assignment.path}\"`)\n    }\n  }\n\n  return { assignments: parsed.data.assignments }\n}\n\n/**\n * INVOKE_AGENT activity handler\n *\n * Runs a callable agent via the agent_orchestrator DI bridge (`agentWorkflowBridge`,\n * an optional peer) and dispositions any proposal:\n * - researcher \u2192 returns the agent data; the step proceeds inline (no park).\n * - auto_approved \u2192 returns the proposalId; the step proceeds inline (no park).\n * - user_task \u2192 returns a result carrying a `__park` marker so the step handler\n *   parks the instance on `INVOKE_AGENT_SIGNAL_NAME`; agent_orchestrator's\n *   dispose path later signals it to resume.\n *\n * `config` is the already-interpolated INVOKE_AGENT config.\n */\ntype AgentWorkflowBridgeLike = {\n  invokeAgentForWorkflow: (args: {\n    agentId: string\n    input: unknown\n    onResult: { autoApproveThreshold: number; autoApproveMargin?: number } | { alwaysAsk: true }\n    ctx: {\n      tenantId: string\n      organizationId: string\n      userId?: string\n      workflowInstanceId: string\n      stepId: string\n      /**\n       * The step-attempt id. With the instance and the step it IS this\n       * invocation's identity, so the run it produces can be correlated by name\n       * rather than by \"the newest run for this agent since now\".\n       */\n      invocationId?: string\n      // Optional interpolated business-record descriptor (invokeAgentConfigSchema.subject).\n      subject?: unknown\n      // Optional already-resolved Review section (spec 7.5) \u2014 who reviews the\n      // proposal this step raises, and by when. Absent means the unassigned\n      // task the disposition service raised before the section existed.\n      review?: AgentDispositionReview\n    }\n  }) => Promise<\n    | { kind: 'research'; data: unknown }\n    | { kind: 'auto_approved'; proposalId: string; payload: unknown }\n    | { kind: 'user_task'; proposalId: string }\n    // The agent proposed nothing: terminal like `researcher`, never parked.\n    | { kind: 'none_proposed'; proposalId: string; payload: unknown }\n    // The agent PRODUCED files. Terminal and non-mutating, so it routes onto the\n    // same governance handle as a research result: the five outcome handles are a\n    // vocabulary of DECISIONS, and \"it made a document\" is not one of them.\n    | { kind: 'artifact'; artifacts: unknown[]; summary?: string }\n  >\n}\n\nfunction tryResolveAgentWorkflowBridge(\n  container: AwilixContainer,\n): AgentWorkflowBridgeLike | undefined {\n  try {\n    return container.resolve<AgentWorkflowBridgeLike>('agentWorkflowBridge')\n  } catch {\n    return undefined\n  }\n}\n\nexport async function executeInvokeAgent(\n  config: unknown,\n  context: ActivityContext,\n  container: AwilixContainer\n): Promise<any> {\n  const parsed = invokeAgentConfigSchema.safeParse(config)\n  if (!parsed.success) {\n    const issues = parsed.error.issues\n      .map((issue) => `${issue.path.join('.') || 'config'}: ${issue.message}`)\n      .join('; ')\n    throw new Error(`INVOKE_AGENT config invalid: ${issues}`)\n  }\n  const { agentId, input, onResult, outputMapping, subject, review } = parsed.data\n\n  // The Review section is resolved HERE, against the context the step ran with,\n  // for the same reason a USER_TASK's assignment is resolved at creation rather\n  // than at read time: a definition edit while the agent is running must not\n  // retro-change who the resulting review task belongs to. `config` reaches this\n  // function already interpolated, so a dynamic assignee is either a resolved id\n  // or an untouched `{{\u2026}}` token \u2014 which `resolveTaskAssignment` reads as the\n  // fallback-to-the-role-queue case.\n  const dispositionReview = toAgentDispositionReview(resolveAgentReview(review, (value) => value))\n\n  // Fail fast when the optional agent_orchestrator peer is absent \u2014 the worker\n  // would otherwise enqueue a job that can never run.\n  const bridge = tryResolveAgentWorkflowBridge(container)\n  if (!bridge) {\n    throw new Error('[internal] agent_orchestrator not installed')\n  }\n\n  const stepId =\n    context.stepContext?.stepId ||\n    context.workflowInstance.currentStepId\n\n  // Resolve the traceable principal this agent run executes as, from the\n  // workflow instance (NOT the unreliable execution `context.userId`, which is\n  // empty for event/sub-workflow paths). Same security model as CALL_API: the\n  // run must never exceed the permissions of the human who triggered (or\n  // authored) the workflow, and there is no anonymous \"system\" fallback \u2014\n  // passing an empty user id downstream both poisons the DB transaction\n  // (invalid uuid `\"\"`) and would mint a session token attributed to no one.\n  const principalEm = container.resolve<PostgreSqlEntityManager>('em')\n  const effectiveUserId = await resolveWorkflowPrincipalUserId(principalEm, context.workflowInstance)\n  if (!effectiveUserId) {\n    throw new Error(\n      `[INVOKE_AGENT] Refusing to execute for workflow instance ${context.workflowInstance.id}: ` +\n      `no traceable user (instance initiatedBy or definition author) could be resolved. ` +\n      `Agent runs must execute under the identity of the user who triggered them.`\n    )\n  }\n\n  // Parallel-branch agent steps keep the legacy inline path. The async fix below\n  // parks and resumes at the INSTANCE level, and sendSignal's FORKED branch\n  // resume only matches WAIT_FOR_SIGNAL steps \u2014 so an instance-level resume would\n  // not reach a parked branch. The claims blueprints (and the common case) run\n  // agents sequentially at the instance level; only rarely-used parallel branches\n  // hit this fallback, where behavior is unchanged from before.\n  if (context.branchInstanceId) {\n    const outcome = await bridge.invokeAgentForWorkflow({\n      agentId,\n      input,\n      onResult,\n      ctx: {\n        tenantId: context.workflowInstance.tenantId,\n        organizationId: context.workflowInstance.organizationId,\n        userId: effectiveUserId,\n        workflowInstanceId: context.workflowInstance.id,\n        stepId,\n        // The step-attempt row id: a retry enters the step again and mints a new\n        // one, so it names THIS attempt and no other.\n        ...(context.stepInstanceId ? { invocationId: context.stepInstanceId } : {}),\n        ...(subject ? { subject } : {}),\n        ...(dispositionReview ? { review: dispositionReview } : {}),\n      },\n    })\n    if (outcome.kind === 'research') {\n      return { kind: 'research', agentId, data: outcome.data }\n    }\n    if (outcome.kind === 'artifact') {\n      return { kind: 'artifact', agentId, artifacts: outcome.artifacts, summary: outcome.summary }\n    }\n    if (outcome.kind === 'auto_approved' || outcome.kind === 'none_proposed') {\n      return { kind: outcome.kind, agentId, proposalId: outcome.proposalId, proposalPayload: outcome.payload }\n    }\n    return {\n      kind: 'user_task',\n      agentId,\n      proposalId: outcome.proposalId,\n      __park: { signalName: INVOKE_AGENT_SIGNAL_NAME },\n    }\n  }\n\n  if (!context.stepInstanceId) {\n    throw new Error('[internal] INVOKE_AGENT requires a step instance to park on')\n  }\n\n  // Run the agent OUTSIDE the workflow transaction. Previously the agent ran\n  // inline here, on the workflow's transactional EM: a failing statement aborted\n  // the whole workflow transaction (\"current transaction is aborted, \u2026\") and,\n  // for cross-process OpenCode agents, the per-run api_key / session rows were\n  // written into the still-open transaction so the separate mcp:serve-http\n  // process could not see them to authenticate submit_outcome. Instead we enqueue\n  // a dedicated job and PARK the step on the proposal-ready signal: the\n  // workflow-invoke-agent worker runs the agent on its own connection (committed,\n  // cross-process visible) and resumes the parked step via sendSignal. user_task\n  // outcomes stay parked until agent_orchestrator's human dispose fires the same\n  // signal \u2014 identical to the prior park behavior.\n  const queue = getInvokeAgentQueue()\n  const job: WorkflowActivityJobInvokeAgent = {\n    kind: 'invoke_agent',\n    workflowInstanceId: context.workflowInstance.id,\n    branchInstanceId: context.branchInstanceId ?? undefined,\n    stepInstanceId: context.stepInstanceId,\n    stepId,\n    signalName: INVOKE_AGENT_SIGNAL_NAME,\n    agentId,\n    input: (input ?? {}) as Record<string, any>,\n    onResult,\n    ...(outputMapping ? { outputMapping } : {}),\n    ...(subject ? { subject } : {}),\n    ...(dispositionReview ? { review: dispositionReview } : {}),\n    tenantId: context.workflowInstance.tenantId,\n    organizationId: context.workflowInstance.organizationId,\n    userId: effectiveUserId,\n  }\n  const jobId = await queue.enqueue(job, { delayMs: INVOKE_AGENT_ENQUEUE_DELAY_MS })\n\n  return {\n    kind: 'pending_agent',\n    agentId,\n    jobId,\n    __park: { signalName: INVOKE_AGENT_SIGNAL_NAME },\n  }\n}\n\n/**\n * CALL_API activity handler\n *\n * Makes authenticated HTTP request to internal Open Mercato APIs\n * - Automatically creates one-time API key for authentication\n * - Injects tenant/organization context headers\n * - Validates URL security (SSRF prevention)\n * - Classifies errors (retriable vs non-retriable)\n * - Deletes API key after request (no stored credentials!)\n */\nexport async function executeCallApi(\n  em: EntityManager,\n  config: any,\n  context: ActivityContext,\n  container: AwilixContainer,\n  signal?: AbortSignal\n): Promise<any> {\n  // 1. Interpolate variables in config (including {{workflow.*}}, {{context.*}}, allowlisted {{env.*}}, {{now}})\n  const interpolatedConfig = interpolateActivityConfig(config, context, 'CALL_API')\n\n  const {\n    endpoint,\n    method = 'GET',\n    headers = {},\n    body,\n    validateTenantMatch = true,\n  } = interpolatedConfig\n\n\n  if (!endpoint) {\n    throw new Error('CALL_API requires \"endpoint\" field')\n  }\n\n  // 2. Build full URL (prepend APP_URL for relative paths)\n  const fullUrl = buildApiUrl(endpoint)\n\n  // 3. Import the one-time API key helper\n  const { withOnetimeApiKey } = await import('../../api_keys/services/apiKeyService')\n\n  // 4. Create the one-time API key on an EntityManager that is fully detached\n  //    from the surrounding request/transaction context.\n  //\n  //    CALL_API runs inside `workflowExecutor.executeWorkflow()`, which wraps\n  //    the whole execution in `em.transactional(...)`. The request EM is forked\n  //    with `useContext: true`, so while that transaction is open, EVERY\n  //    operation on the container's `em` \u2014 including this API key's\n  //    persist/flush \u2014 is transparently redirected to the uncommitted\n  //    transaction fork (MikroORM `getContext()` \u2192 `TransactionContext`). The\n  //    key would therefore stay invisible until the transaction commits, but\n  //    the commit cannot happen until this activity returns. The outbound\n  //    self-authenticated `fetch` below opens a SEPARATE DB connection that\n  //    cannot see the uncommitted row, so the internal API responds `401` and\n  //    the activity fails (issue #4202).\n  //\n  //    Forking with `useContext: false` (matching the query_index/webhooks\n  //    isolated-EM convention) gives the key its own pooled connection with\n  //    autocommit, so it is committed and visible to the internal request\n  //    immediately.\n  const apiKeyEm = container\n    .resolve<PostgreSqlEntityManager>('em')\n    .fork({ clear: true, freshEventManager: true, useContext: false }) as PostgreSqlEntityManager\n\n  // 5. Resolve the roles that the one-time API key will inherit.\n  //\n  // SECURITY: The key must never exceed the permissions of the human who\n  //   triggered (or authored) this workflow. Previously this code looked up\n  //   a role named \"admin\"/\"superadmin\" for the tenant and assigned it to\n  //   the key \u2014 which allowed any non-admin workflow author with\n  //   `workflows.definitions.edit` + `workflows.instances.create` to issue\n  //   arbitrary administrative API calls via a CALL_API activity. See the\n  //   SECURITY.md changelog entry for this fix.\n  //\n  //   The resolution strategy is:\n  //     1. Use the workflow instance's `metadata.initiatedBy` user (whoever\n  //        manually started the instance), when available. Only this user's\n  //        current active roles are used \u2014 we never fall back to the author\n  //        when the initiator is known, because that would escalate the\n  //        initiator's privileges.\n  //     2. Fall back to the workflow definition's `createdBy` (author) only\n  //        when the instance was started by an event trigger with no user.\n  //     3. If no traceable principal exists, the activity refuses to run \u2014\n  //        there is no \"system\" fallback that bypasses RBAC.\n  const resolvedRoleIds = await resolveCallApiRoleIds(apiKeyEm, context.workflowInstance)\n\n  if (resolvedRoleIds.length === 0) {\n    throw new Error(\n      `[CALL_API] Refusing to execute CALL_API for workflow instance ${context.workflowInstance.id}: ` +\n      `no traceable user roles could be resolved from the workflow instance or definition. ` +\n      `CALL_API activities must run under the identity of the user who triggered them.`\n    )\n  }\n\n  // 6. Execute request with one-time API key scoped to the resolved user's roles\n  return await withOnetimeApiKey(\n    apiKeyEm,\n    {\n      name: `__workflow_${context.workflowInstance.id}__`,\n      description: `One-time key for workflow ${context.workflowInstance.workflowId} instance ${context.workflowInstance.id}`,\n      tenantId: context.workflowInstance.tenantId,\n      organizationId: context.workflowInstance.organizationId,\n      roles: resolvedRoleIds,\n      expiresAt: null,\n    },\n    async (apiKeySecret) => {\n      // Build request headers (auth + context + custom)\n      const requestHeaders: Record<string, string> = {\n        'Content-Type': 'application/json',\n        'Authorization': `apikey ${apiKeySecret}`,\n        'X-Tenant-Id': context.workflowInstance.tenantId,\n        'X-Organization-Id': context.workflowInstance.organizationId,\n        'X-Workflow-Instance-Id': context.workflowInstance.id,\n        ...headers,\n      }\n\n      // Make HTTP request\n      const response = await fetch(fullUrl, {\n        method,\n        headers: requestHeaders,\n        body: body ? JSON.stringify(body) : undefined,\n        signal,\n      })\n\n      // Parse response body (JSON-safe)\n      let responseBody: any\n      const contentType = response.headers.get('content-type')\n\n      try {\n        if (contentType && contentType.includes('application/json')) {\n          responseBody = await response.json()\n        } else {\n          responseBody = await response.text()\n        }\n      } catch (error) {\n        responseBody = null\n      }\n\n      // Check for HTTP errors and classify\n      if (!response.ok) {\n        classifyAndThrowError(response.status, responseBody, fullUrl)\n      }\n\n      // Validate tenant match (security check)\n      if (validateTenantMatch && responseBody && typeof responseBody === 'object') {\n        if (responseBody.tenantId && responseBody.tenantId !== context.workflowInstance.tenantId) {\n          throw new Error(\n            `Tenant ID mismatch: workflow expects ${context.workflowInstance.tenantId} but API returned ${responseBody.tenantId}`\n          )\n        }\n      }\n\n      // Return structured result\n      return {\n        status: response.status,\n        statusText: response.statusText,\n        headers: Object.fromEntries(response.headers.entries()),\n        body: responseBody,\n        authenticated: true,\n        tenantId: context.workflowInstance.tenantId,\n        organizationId: context.workflowInstance.organizationId,\n      }\n    }\n  )\n}\n\n// ============================================================================\n// CALL_API Helper Functions\n// ============================================================================\n\nexport type CallApiInstanceLike = {\n  id: string\n  tenantId: string\n  organizationId: string\n  definitionId: string\n  metadata?: { initiatedBy?: string | null } | null\n}\n\nasync function resolveActiveRoleIdsForUser(\n  em: any,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<string[]> {\n  const { findOneWithDecryption, findWithDecryption } = await import('@open-mercato/shared/lib/encryption/find')\n  const { User, UserRole, Role } = await import('../../auth/data/entities')\n\n  const user = await findOneWithDecryption(em, User, {\n    id: userId,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  }, {}, scope)\n  if (!user) return []\n\n  const userRoles = await findWithDecryption(\n    em,\n    UserRole,\n    { user: user.id, deletedAt: null },\n    { populate: ['role'] },\n    scope,\n  )\n  const roleIds = userRoles\n    .map((ur: any) => (typeof ur.role === 'string' ? ur.role : ur.role?.id))\n    .filter((id: unknown): id is string => typeof id === 'string' && id.length > 0)\n\n  if (roleIds.length === 0) return []\n\n  const scopedRoles = await findWithDecryption(em, Role, {\n    id: { $in: roleIds },\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  }, {}, scope)\n  return scopedRoles.map((r: any) => r.id as string)\n}\n\n/**\n * Loads the instance's definition (including soft-deleted rows, so an execution\n * grant on a deleted definition still binds a run that is still executing).\n */\nasync function loadInstanceDefinition(em: any, instance: CallApiInstanceLike) {\n  if (!instance.definitionId) return null\n  const { findOneWithDecryption } = await import('@open-mercato/shared/lib/encryption/find')\n  const { WorkflowDefinition } = await import('../data/entities')\n  return findOneWithDecryption(\n    em,\n    WorkflowDefinition,\n    { id: instance.definitionId, tenantId: instance.tenantId },\n    {},\n    { tenantId: instance.tenantId, organizationId: instance.organizationId },\n  )\n}\n\nexport async function resolveCallApiRoleIds(\n  em: any,\n  instance: CallApiInstanceLike\n): Promise<string[]> {\n  if (!instance.definitionId) return []\n\n  const scope = { tenantId: instance.tenantId, organizationId: instance.organizationId }\n  const definition = await loadInstanceDefinition(em, instance)\n\n  // 0. A definition that declares its own execution grant ALWAYS acts as its\n  //    own least-privilege principal, whoever started the run \u2014 otherwise a\n  //    CALL_API activity would mint a key carrying the starting admin's roles\n  //    and route straight around the grant.\n  if (definitionDeclaresGrant(definition)) {\n    const principalUserId = await resolveWorkflowDefinitionExecutionUserId(em, definition, null)\n    return principalUserId ? resolveActiveRoleIdsForUser(em, principalUserId, scope) : []\n  }\n\n  // 1. Prefer the triggering user (whoever manually started this instance).\n  //    WorkflowInstance.metadata.initiatedBy is the canonical record of that\n  //    principal for user-started instances; use their current role set so\n  //    CALL_API never exceeds the initiator's permissions. Refuse if the\n  //    initiator has no active scoped roles \u2014 do not fall back to the\n  //    definition author, which would escalate the initiator's privileges.\n  const initiatorUserId = instance.metadata?.initiatedBy ?? null\n  if (initiatorUserId) {\n    return resolveActiveRoleIdsForUser(em, initiatorUserId, scope)\n  }\n\n  // 2. Event-triggered instance with no human initiator: fall back to the\n  //    definition author. Soft-deleted definitions must not mint keys.\n  const authorUserId = definition?.deletedAt ? null : definition?.createdBy\n  if (!authorUserId) return []\n\n  return resolveActiveRoleIdsForUser(em, authorUserId, scope)\n}\n\n/**\n * Resolve the traceable principal user id an INVOKE_AGENT run executes as.\n *\n * Mirrors `resolveCallApiRoleIds`' principal chain so workflow-originated agent\n * runs carry the same audited identity as CALL_API:\n *   1. The instance's `metadata.initiatedBy` (whoever started it; inherited by\n *      sub-workflows from the parent instance).\n *   2. The definition's `createdBy` (author) for event-triggered instances with\n *      no human initiator. Soft-deleted definitions resolve to no principal.\n *\n * Both are outranked by the definition's own `grantedFeatures` execution\n * principal when it declares one (see `lib/definition-grant.ts`).\n *\n * Returns `null` when no traceable principal exists \u2014 callers MUST refuse rather\n * than fall back to an empty/anonymous user id (which breaks uuid columns and\n * bypasses RBAC attribution).\n */\nexport async function resolveWorkflowPrincipalUserId(\n  em: any,\n  instance: CallApiInstanceLike\n): Promise<string | null> {\n  const definition = await loadInstanceDefinition(em, instance)\n\n  // 0. A declared execution grant outranks both \u2014 the run acts as its own\n  //    principal regardless of who started it.\n  if (definitionDeclaresGrant(definition)) {\n    return resolveWorkflowDefinitionExecutionUserId(em, definition, null)\n  }\n\n  const initiatorUserId = instance.metadata?.initiatedBy ?? null\n  if (initiatorUserId) return initiatorUserId\n\n  if (definition?.deletedAt) return null\n  return definition?.createdBy ?? null\n}\n\n/**\n * Build full API URL from endpoint\n * - Relative paths (/api/...) \u2192 prepend APP_URL\n * - Absolute URLs \u2192 validate domain matches APP_URL (SSRF prevention)\n */\nfunction buildApiUrl(endpoint: string): string {\n  const appUrl = process.env.APP_URL || 'http://localhost:3000'\n\n  // Relative path - prepend APP_URL\n  if (endpoint.startsWith('/')) {\n    // Security: Only allow /api/* paths\n    if (!endpoint.startsWith('/api/')) {\n      throw new Error(`CALL_API only supports /api/* paths, got: ${endpoint}`)\n    }\n    return `${appUrl}${endpoint}`\n  }\n\n  // Absolute URL - validate domain matches APP_URL (SSRF prevention)\n  try {\n    const endpointUrl = new URL(endpoint)\n    const appUrlObj = new URL(appUrl)\n\n    if (endpointUrl.host !== appUrlObj.host) {\n      throw new Error(\n        `SSRF Prevention: CALL_API endpoint domain (${endpointUrl.host}) does not match APP_URL (${appUrlObj.host})`\n      )\n    }\n\n    return endpoint\n  } catch (error) {\n    if (error instanceof TypeError) {\n      throw new Error(`Invalid endpoint URL: ${endpoint}`)\n    }\n    throw error\n  }\n}\n\n/**\n * Classify HTTP error and throw appropriate error\n * - 400-499: Non-retriable (client error - validation/auth)\n * - 500-599: Retriable (server error)\n */\nfunction classifyAndThrowError(status: number, body: any, url: string): never {\n  const bodyStr = typeof body === 'string' ? body : JSON.stringify(body)\n\n  if (status >= 400 && status < 500) {\n    // Client errors - non-retriable\n    throw new Error(\n      `CALL_API request failed with status ${status} (non-retriable): ${bodyStr}`\n    )\n  }\n\n  if (status >= 500) {\n    // Server errors - retriable\n    const error: any = new Error(\n      `CALL_API request failed with status ${status} (retriable): ${bodyStr}`\n    )\n    error.retriable = true\n    throw error\n  }\n\n  // Other errors\n  throw new Error(`CALL_API request failed with status ${status}: ${bodyStr}`)\n}\n\n// ============================================================================\n// Helper Functions\n// ============================================================================\n\ntype InterpolationBaseResolution =\n  | { status: 'resolved'; value: unknown }\n  | { status: 'unresolved-context'; contextPath: string }\n  | { status: 'unknown-workflow-key'; workflowKey: string }\n  | { status: 'env-not-allowlisted'; envKey: string }\n\nfunction resolveInterpolationBaseValue(\n  path: string,\n  context: Record<string, any>,\n  workflowInstance?: WorkflowInstance\n): InterpolationBaseResolution {\n  if (path.startsWith('workflow.') && workflowInstance) {\n    const workflowKey = path.substring('workflow.'.length)\n    switch (workflowKey) {\n      case 'instanceId':\n        return { status: 'resolved', value: workflowInstance.id }\n      case 'tenantId':\n        return { status: 'resolved', value: workflowInstance.tenantId }\n      case 'organizationId':\n        return { status: 'resolved', value: workflowInstance.organizationId }\n      case 'currentStepId':\n        return { status: 'resolved', value: workflowInstance.currentStepId }\n      case 'workflowId':\n        return { status: 'resolved', value: workflowInstance.workflowId }\n      case 'version':\n        return { status: 'resolved', value: workflowInstance.version }\n      default:\n        return { status: 'unknown-workflow-key', workflowKey }\n    }\n  }\n\n  if (path.startsWith('env.')) {\n    const envKey = path.substring('env.'.length)\n    if (!getWorkflowEnvInterpolationAllowlist().has(envKey)) {\n      return { status: 'env-not-allowlisted', envKey }\n    }\n    return { status: 'resolved', value: process.env[envKey] ?? '' }\n  }\n\n  if (path === 'now') {\n    return { status: 'resolved', value: new Date().toISOString() }\n  }\n\n  const contextPath = path.startsWith('context.') ? path.substring('context.'.length) : path\n  const value = getNestedValue(context, contextPath)\n  if (value !== undefined) return { status: 'resolved', value }\n  return { status: 'unresolved-context', contextPath }\n}\n\nfunction strictInterpolationError(rawToken: string, reason: string): WorkflowInterpolationError {\n  return new WorkflowInterpolationError(\n    `Cannot interpolate {{${rawToken}}}: ${reason}`,\n    rawToken\n  )\n}\n\nfunction interpolateToken(\n  rawToken: string,\n  context: Record<string, any>,\n  workflowInstance: WorkflowInstance | undefined,\n  strict: boolean\n): { resolved: boolean; value?: unknown } {\n  const parsedToken = parseInterpolationToken(rawToken)\n  if (!parsedToken.ok) {\n    if (strict) throw strictInterpolationError(rawToken, parsedToken.error)\n    return { resolved: false }\n  }\n  const resolution = resolveInterpolationBaseValue(parsedToken.path, context, workflowInstance)\n  if (resolution.status === 'unknown-workflow-key') {\n    if (strict) throw strictInterpolationError(rawToken, `unknown workflow key \"${resolution.workflowKey}\"`)\n    return { resolved: false }\n  }\n  if (resolution.status === 'env-not-allowlisted') {\n    if (strict) throw strictInterpolationError(rawToken, `env variable \"${resolution.envKey}\" is not allowlisted`)\n  }\n  const baseValue =\n    resolution.status === 'resolved'\n      ? resolution.value\n      : resolution.status === 'env-not-allowlisted'\n        ? ''\n        : undefined\n  if (parsedToken.transforms.length === 0) {\n    if (resolution.status === 'unresolved-context') {\n      if (strict) throw strictInterpolationError(rawToken, `context path \"${resolution.contextPath}\" is not defined`)\n      return { resolved: false }\n    }\n    return { resolved: true, value: baseValue }\n  }\n  const transformed = applyTransforms(baseValue, parsedToken.transforms)\n  if (!transformed.ok) {\n    if (strict) throw strictInterpolationError(rawToken, transformed.error.message)\n    return { resolved: false }\n  }\n  if (transformed.value === undefined) {\n    if (strict) throw strictInterpolationError(rawToken, 'the transform pipeline produced no value')\n    return { resolved: false }\n  }\n  return { resolved: true, value: transformed.value }\n}\n\n/**\n * Interpolate variables in config from workflow context\n *\n * Supports syntax:\n * - {{context.field}} or {{context.nested.field}} - from workflow context\n * - {{workflow.instanceId}} - workflow instance ID\n * - {{workflow.tenantId}} - tenant ID\n * - {{workflow.organizationId}} - organization ID\n * - {{workflow.currentStepId}} - current step ID\n * - {{env.VAR_NAME}} - server-allowlisted environment variables\n * - {{now}} - current ISO timestamp\n * - {{ path | transform(args) | ... }} - pill transform pipeline\n *   (`lib/interpolation-pipeline.ts`): a fixed table of pure transforms folded\n *   over the resolved base value. Lenient behavior (the default): an\n *   unparseable token, an unresolved path without a rescuing `default`, or a\n *   failed transform passes the original token/config through unchanged. In\n *   strict mode (`options.mode: 'strict'`, opted in per definition) the same\n *   situations throw `WorkflowInterpolationError` naming the offending token;\n *   only a `default(...)` transform can rescue an unresolved context path.\n */\nexport function interpolateVariables(\n  config: any,\n  context: Record<string, any>,\n  workflowInstance?: WorkflowInstance,\n  options?: { mode?: WorkflowInterpolationMode }\n): any {\n  const strict = options?.mode === 'strict'\n  if (typeof config === 'string') {\n    // Check if this is a single variable reference (e.g., \"{{context.cart.items}}\")\n    // This preserves the original type (array, object, number, boolean)\n    const singleVarMatch = config.match(/^\\{\\{([^}]+)\\}\\}$/)\n\n    if (singleVarMatch) {\n      const outcome = interpolateToken(singleVarMatch[1], context, workflowInstance, strict)\n      return outcome.resolved ? outcome.value : config\n    }\n\n    // Multiple interpolations or mixed text - return string\n    return config.replace(/\\{\\{([^}]+)\\}\\}/g, (match, token) => {\n      const outcome = interpolateToken(token, context, workflowInstance, strict)\n      return outcome.resolved ? String(outcome.value) : match\n    })\n  }\n\n  if (Array.isArray(config)) {\n    return config.map((item) => interpolateVariables(item, context, workflowInstance, options))\n  }\n\n  if (config && typeof config === 'object') {\n    const result: Record<string, any> = {}\n    for (const [key, value] of Object.entries(config)) {\n      result[key] = interpolateVariables(value, context, workflowInstance, options)\n    }\n    return result\n  }\n\n  return config\n}\n\nfunction interpolateActivityConfig(\n  config: any,\n  context: ActivityContext,\n  activityType: ActivityType,\n  activityName?: string\n): any {\n  try {\n    return interpolateVariables(config, context.workflowContext, context.workflowInstance, {\n      mode: context.interpolationMode,\n    })\n  } catch (error) {\n    if (error instanceof WorkflowInterpolationError) {\n      throw new ActivityExecutionError(error.message, activityType, activityName, { token: error.token })\n    }\n    throw error\n  }\n}\n\n/**\n * Get nested value from object by path (e.g., \"user.email\")\n */\nfunction getNestedValue(obj: any, path: string): any {\n  const parts = path.split('.')\n  let value = obj\n\n  for (const part of parts) {\n    if (value && typeof value === 'object' && part in value) {\n      value = value[part]\n    } else {\n      return undefined\n    }\n  }\n\n  return value\n}\n\n/**\n * Calculate exponential backoff delay\n */\nfunction calculateBackoff(\n  initialIntervalMs: number,\n  backoffCoefficient: number,\n  attempt: number,\n  maxIntervalMs: number\n): number {\n  const backoff = initialIntervalMs * Math.pow(backoffCoefficient, attempt)\n  return Math.min(backoff, maxIntervalMs || Infinity)\n}\n\n/**\n * Sleep for specified milliseconds\n */\nfunction sleep(ms: number): Promise<void> {\n  return new Promise((resolve) => setTimeout(resolve, ms))\n}\n\n/**\n * Execute a promise with timeout\n *\n * AbortController.signal is threaded into every activity handler on both the\n * synchronous (`executeActivity`) and asynchronous worker (`activity-worker-handler`)\n * paths. CALL_API / CALL_WEBHOOK forward it to `fetch`. SEND_EMAIL forwards it to\n * `emailService.send` (honouring is optional per implementation). EMIT_EVENT and\n * UPDATE_ENTITY check it before dispatch and race their awaits against it via\n * `raceAbortable` \u2014 neither the event bus nor the command bus declare a `signal`\n * parameter, so a write/emit that has already begun cannot be rolled back.\n * EXECUTE_FUNCTION forwards it as its third argument (#5148 / #4918).\n */\nasync function executeWithTimeout<T>(\n  executor: (signal: AbortSignal) => Promise<T>,\n  timeoutMs: number\n): Promise<T> {\n  let timeoutId: NodeJS.Timeout\n  const abortController = new AbortController()\n\n  const timeoutPromise = new Promise<never>((_, reject) => {\n    timeoutId = setTimeout(() => {\n      abortController.abort()\n      reject(new Error(`Activity execution timeout after ${timeoutMs}ms`))\n    }, timeoutMs)\n  })\n\n  try {\n    return await Promise.race([executor(abortController.signal), timeoutPromise])\n  } finally {\n    clearTimeout(timeoutId!)\n  }\n}\n\nfunction createActivityAbortError(signal?: AbortSignal): Error {\n  if (signal?.reason instanceof Error) return signal.reason\n  try {\n    return new DOMException('The operation was aborted', 'AbortError')\n  } catch {\n    const error = new Error('The operation was aborted')\n    error.name = 'AbortError'\n    return error\n  }\n}\n\nfunction throwIfAborted(signal?: AbortSignal): void {\n  if (signal?.aborted) {\n    throw createActivityAbortError(signal)\n  }\n}\n\n/**\n * Reject when `signal` aborts while `promise` is still pending. Does not cancel\n * an underlying effect that cannot honour AbortSignal \u2014 callers must pass the\n * signal into that effect when it can.\n */\nfunction raceAbortable<T>(promise: Promise<T>, signal?: AbortSignal): Promise<T> {\n  if (!signal) return promise\n  if (signal.aborted) {\n    return Promise.reject(createActivityAbortError(signal))\n  }\n  return new Promise<T>((resolve, reject) => {\n    const onAbort = () => {\n      reject(createActivityAbortError(signal))\n    }\n    signal.addEventListener('abort', onAbort, { once: true })\n    promise.then(\n      (value) => {\n        signal.removeEventListener('abort', onAbort)\n        resolve(value)\n      },\n      (error) => {\n        signal.removeEventListener('abort', onAbort)\n        reject(error)\n      }\n    )\n  })\n}\n\nbindActivityExecutor({\n  executeSendEmail,\n  executeEmitEvent,\n  executeUpdateEntity,\n  executeCallWebhook,\n  executeFunction,\n  executeCallApi,\n  executeSetVariable,\n  executeInvokeAgent,\n})\n"],
+  "mappings": "AAgBA,SAAS,yBAAgC;AAEzC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,+BAA+B;AACxC,SAAS,2CAA2C;AAEpD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAEP,SAAS,0CAA0E;AACnF;AAAA,EAGE;AAAA,EACA;AAAA,OACK;AACP,OAAO;AACP,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,wBAAwB;AACjC,SAAS,4BAA2C;AAEpD,SAAS,wBAAAA,6BAA4B;AACrC,SAAS,gCAAgC;AACzC,SAAS,8BAA8B;AACvC,SAAS,gCAAgC;AACzC,SAAS,gDAAgD;AACzD,SAAS,oBAAoB,gCAAgC;AAG7D,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,SAAS,2CAAoD;AAC3D,MAAI,wBAAwB,QAAQ,IAAI,iCAAiC,KAAK,GAAG;AAC/E,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,aAAO,KAAK,sGAAsG,EAAE,WAAW,eAAe,CAAC;AAC/I,aAAO;AAAA,IACT;AAEA,WAAO,KAAK,2HAA2H,EAAE,WAAW,eAAe,CAAC;AACpK,WAAO;AAAA,EACT;AAEA,MAAI,wBAAwB,QAAQ,IAAI,qCAAqC,KAAK,GAAG;AACnF,QAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,aAAO,KAAK,2KAA2K,EAAE,WAAW,eAAe,CAAC;AACpN,aAAO;AAAA,IACT;AAEA,WAAO,KAAK,gIAAgI,EAAE,WAAW,eAAe,CAAC;AACzK,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,MAAM,+CAA+C,oBAAI,IAAI,CAAC,SAAS,CAAC;AACxE,MAAM,2CAA2C;AAEjD,SAAS,uCAAoD;AAC3D,QAAM,YAAY,IAAI,IAAI,4CAA4C;AACtE,QAAM,iBAAiB,QAAQ,IAAI,wCAAwC;AAC3E,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAEA,aAAW,OAAO,eAAe,MAAM,GAAG,GAAG;AAC3C,UAAM,aAAa,IAAI,KAAK;AAC5B,QAAI,YAAY;AACd,gBAAU,IAAI,UAAU;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO;AACT;AAuBO,MAAM,2BAA2B;AAQjC,MAAM,2BAA2B;AAQjC,MAAM,gCAAgC;AAUtC,SAAS,sBAAsB,QAA4C;AAChF,MAAI,UAAU,OAAO,WAAW,YAAY,YAAY,QAAQ;AAC9D,UAAM,OAAQ,OAAgC;AAC9C,QAAI,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAkC,eAAe,UAAU;AACzG,aAAO,EAAE,YAAa,KAAgC,WAAW;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAmDA,eAAe,2BACb,WACA,QACA,UACA,UACA,gBACkB;AAClB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,MAAM,oBAAoB;AAC5B,aAAO,MAAM,KAAK,mBAAmB,QAAQ,CAAC,GAAG,QAAQ,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IAC1F;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAsBO,MAAM,+BAA+B,MAAM;AAAA,EAChD,YACE,SACO,cACA,cACA,SACP;AACA,UAAM,OAAO;AAJN;AACA;AACA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AASO,MAAM,mCAAmC,MAAM;AAAA,EACpD,YACE,SACO,OACP;AACA,UAAM,OAAO;AAFN;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAMA,IAAI,gBAAmD;AACvD,IAAI,mBAAsD;AAK1D,SAAS,mBAA+C;AACtD,MAAI,CAAC,eAAe;AAClB,oBAAgB;AAAA,MACd;AAAA,MACA,EAAE,aAAa,SAAS,QAAQ,IAAI,+BAA+B,GAAG,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,SAAO;AACT;AASA,SAAS,sBAAkD;AACzD,MAAI,CAAC,kBAAkB;AACrB,uBAAmB;AAAA,MACjB;AAAA,MACA,EAAE,aAAa,SAAS,QAAQ,IAAI,6CAA6C,KAAK,EAAE,EAAE;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO;AACT;AAUA,eAAsB,gBACpB,IACA,UACA,SACiB;AACjB,QAAM,EAAE,kBAAkB,iBAAiB,aAAa,cAAc,gBAAgB,iBAAiB,IACrG;AAEF,QAAM,gBAAgB,gBAAgB,SAAS,YAAY;AAC3D,MAAI,iBAAiB,cAAc,MAAM,YAAY,OAAO;AAC1D,UAAM,IAAI;AAAA,MACR,4BAA4B,SAAS,YAAY,+BAA+B,cAAc,MAAM,MAAM;AAAA,MAC1G,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAIA,QAAM,qBAAqB;AAAA,IACzB,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AAGA,QAAM,MAA2B;AAAA,IAC/B,oBAAoB,iBAAiB;AAAA,IACrC;AAAA,IACA,kBAAkB,oBAAoB;AAAA,IACtC;AAAA,IACA,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS,gBAAgB,SAAS;AAAA,IAChD,cAAc,SAAS;AAAA,IACvB,gBAAgB;AAAA,IAChB;AAAA,IACA;AAAA,IACA,aAAa,SAAS;AAAA,IACtB,WAAW,SAAS;AAAA,IACpB,UAAU,iBAAiB;AAAA,IAC3B,gBAAgB,iBAAiB;AAAA,IACjC,QAAQ,QAAQ;AAAA,EAClB;AAGA,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,kBAAkB,eAAe,iBACnC,cAAc,eAAe,kBAAkB,IAC/C;AACJ,QAAM,iBAAiB,oBAAoB,OAAO,EAAE,SAAS,gBAAgB,IAAI;AACjF,QAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,cAAc;AAGrD,QAAM,iBAAiB,IAAI;AAAA,IACzB,oBAAoB,iBAAiB;AAAA,IACrC;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,MACT,YAAY,SAAS;AAAA,MACrB,cAAc,SAAS;AAAA,MACvB,cAAc,SAAS;AAAA,MACvB,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,UAAU,iBAAiB;AAAA,IAC3B,gBAAgB,iBAAiB;AAAA,EACnC,CAAC;AAED,SAAO;AACT;AAQA,eAAsB,gBAAgB,QASlB;AAClB,QAAM,EAAE,oBAAoB,gBAAgB,kBAAkB,UAAU,gBAAgB,QAAQ,QAAQ,QAAQ,IAC9G;AAEF,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,QAAQ,MAAM,MAAM;AAAA,IACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,kBAAkB,oBAAoB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,UAAU,OAAU;AAAA,EAC/C;AAEA,SAAO;AACT;AAYA,eAAsB,kBAAkB,QAYpB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,QAAQ,iBAAiB;AAC/B,SAAO,MAAM,MAAM;AAAA,IACjB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,kBAAkB,oBAAoB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,UAAU,OAAU;AAAA,EAC/C;AACF;AAUA,eAAsB,yBAAyB,QAU3B;AAClB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,IAAI;AAEJ,QAAM,QAAQ,iBAAiB;AAC/B,QAAM,QAAQ,MAAM,MAAM;AAAA,IACxB;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,kBAAkB,oBAAoB;AAAA,MACtC;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,SAAS,UAAU,IAAI,UAAU,OAAU;AAAA,EAC/C;AAEA,SAAO;AACT;AAeA,eAAsB,gBACpB,IACA,WACA,UACA,SACkC;AAClC,QAAM,cAAc,SAAS,eAAe;AAAA,IAC1C,aAAa;AAAA,IACb,mBAAmB;AAAA,IACnB,oBAAoB;AAAA,IACpB,eAAe;AAAA,EACjB;AAEA,MAAI;AACJ,MAAI,aAAa;AAEjB,WAAS,UAAU,GAAG,UAAU,YAAY,aAAa,WAAW;AAClE,QAAI;AACF,YAAM,YAAY,KAAK,IAAI;AAI3B,YAAM,YAAY,yBAAyB,QAAQ;AACnD,YAAM,SAAS,YACX,MAAM;AAAA,QACJ,CAAC,WAAW,sBAAsB,IAAI,WAAW,UAAU,SAAS,MAAM;AAAA,QAC1E;AAAA,MACF,IACA,MAAM,sBAAsB,IAAI,WAAW,UAAU,OAAO;AAEhE,YAAM,kBAAkB,KAAK,IAAI,IAAI;AAErC,aAAO;AAAA,QACL,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS;AAAA,QACvB,cAAc,SAAS;AAAA,QACvB,SAAS;AAAA,QACT,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ;AAAA,QACA,OAAO,SAAS,SAAS;AAAA,MAC3B;AAAA,IACF,SAAS,OAAO;AACd,kBAAY;AACZ,mBAAa,UAAU;AAKvB,UAAI,gBAAgB,KAAK,EAAG;AAG5B,UAAI,UAAU,YAAY,cAAc,GAAG;AACzC,eAAO,MAAM,+BAA+B;AAAA,UAC1C,YAAY,SAAS;AAAA,UACrB,cAAc,SAAS;AAAA,UACvB,SAAS,UAAU;AAAA,UACnB,aAAa,YAAY;AAAA,UACzB,YAAY,QAAQ,iBAAiB;AAAA,UACrC,KAAK;AAAA,QACP,CAAC;AAAA,MACH;AAGA,UAAI,UAAU,YAAY,cAAc,GAAG;AACzC,cAAM,UAAU;AAAA,UACd,YAAY;AAAA,UACZ,YAAY;AAAA,UACZ;AAAA,UACA,YAAY;AAAA,QACd;AAEA,cAAM,MAAM,OAAO;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAGA,QAAM,eAAe,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS;AACtF,MAAI,gBAAgB,SAAS,GAAG;AAC9B,WAAO;AAAA,MACL,YAAY,SAAS;AAAA,MACrB,cAAc,SAAS;AAAA,MACvB,cAAc,SAAS;AAAA,MACvB,SAAS;AAAA,MACT,eAAe;AAAA,MACf,OAAO,kCAAkC,UAAU,YAAY,yBAAyB,UAAU,MAAM;AAAA,MACxG,YAAY;AAAA,MACZ,iBAAiB;AAAA,MACjB,OAAO,SAAS,SAAS;AAAA,IAC3B;AAAA,EACF;AACA,SAAO,MAAM,sCAAsC;AAAA,IACjD,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS;AAAA,IACvB,UAAU;AAAA,IACV,YAAY,QAAQ,iBAAiB;AAAA,IACrC,KAAK;AAAA,EACP,CAAC;AAED,SAAO;AAAA,IACL,YAAY,SAAS;AAAA,IACrB,cAAc,SAAS;AAAA,IACvB,cAAc,SAAS;AAAA,IACvB,SAAS;AAAA,IACT,OAAO,yBAAyB,UAAU,cAAc,YAAY;AAAA,IACpE;AAAA,IACA,iBAAiB;AAAA,IACjB,OAAO,SAAS,SAAS;AAAA,EAC3B;AACF;AAYA,eAAsB,kBACpB,IACA,WACA,YACA,SACoC;AACpC,QAAM,UAAqC,CAAC;AAM5C,QAAM,mBAAmB,iBAAiB,QAAQ,gBAAgB;AAElE,WAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AAC1C,UAAM,WAAW,WAAW,CAAC;AAG7B,QAAI,SAAS,SAAS,CAAC,kBAAkB;AAEvC,YAAM,QAAQ,MAAM,gBAAgB,IAAI,UAAU,OAAO;AAEzD,cAAQ,KAAK;AAAA,QACX,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS;AAAA,QACvB,cAAc,SAAS;AAAA,QACvB,SAAS;AAAA;AAAA,QACT,OAAO;AAAA,QACP;AAAA,QACA,YAAY;AAAA,QACZ,iBAAiB;AAAA,MACnB,CAAC;AAAA,IACH,OAAO;AAEL,YAAM,WAAW,MAAM,gBAAgB,IAAI,WAAW,UAAU,OAAO;AAQvE,YAAM,SAAS,oBAAoB,SAAS,QACxC,EAAE,GAAG,UAAU,OAAO,MAAM,IAC5B;AACJ,cAAQ,KAAK,MAAM;AAGnB,UAAI,CAAC,OAAO,SAAS;AACnB;AAAA,MACF;AAKA,UAAI,OAAO,UAAU,OAAO,OAAO,WAAW,UAAU;AACtD,YAAI,SAAS,iBAAiB,kBAAkB,oBAAoB,OAAO,MAAM,GAAG;AAClF,kBAAQ,kBAAkB;AAAA,YACxB,GAAG,QAAQ;AAAA,YACX,GAAG,6BAA6B,QAAQ,iBAAiB,OAAO,OAAO,WAAW;AAAA,UACpF;AAAA,QACF,OAAO;AACL,gBAAM,MAAM,SAAS,gBAAgB,SAAS;AAC9C,kBAAQ,kBAAkB;AAAA,YACxB,GAAG,QAAQ;AAAA,YACX,CAAC,GAAG,GAAG,OAAO;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,eAAe,sBACb,IACA,WACA,UACA,SACA,QACc;AAEd,QAAM,qBAAqB;AAAA,IACzB,SAAS;AAAA,IACT;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,EACX;AAEA,QAAM,QAAQ,gBAAgB,SAAS,YAAY;AACnD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,0BAA0B,SAAS,YAAY;AAAA,MAC/C,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AAAA,EACF;AAOA,MAAI,iBAAiB,QAAQ,gBAAgB,GAAG;AAC9C,QAAI,MAAM,SAAS,YAAY,MAAM,SAAS,QAAW;AACvD,YAAM,UAAU,IAAI;AAAA,QAClB,SAAS;AAAA,QACT,MAAM,SAAS,WAAW,YAAY;AAAA,QACtC,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,IAAI;AAAA,QACzB,oBAAoB,QAAQ,iBAAiB;AAAA,QAC7C,gBAAgB,QAAQ;AAAA,QACxB,WAAW,oBAAoB;AAAA,QAC/B,WAAW;AAAA,UACT,YAAY,SAAS;AAAA,UACrB,cAAc,SAAS;AAAA,UACvB,cAAc,SAAS;AAAA,UACvB,QAAQ,QAAQ;AAAA,QAClB;AAAA,QACA,UAAU,QAAQ,iBAAiB;AAAA,QACnC,gBAAgB,QAAQ,iBAAiB;AAAA,MAC3C,CAAC;AACD,YAAM;AAAA,IACR;AAEA,UAAM,YAAY,MAAM,KAAK,oBAAoB,OAAO;AACxD,UAAM,iBAAiB,IAAI;AAAA,MACzB,oBAAoB,QAAQ,iBAAiB;AAAA,MAC7C,gBAAgB,QAAQ;AAAA,MACxB,WAAW,oBAAoB;AAAA,MAC/B,WAAW;AAAA,QACT,YAAY,SAAS;AAAA,QACrB,cAAc,SAAS;AAAA,QACvB,cAAc,SAAS;AAAA,QACvB,QAAQ,aAAa;AAAA,MACvB;AAAA,MACA,UAAU,QAAQ,iBAAiB;AAAA,MACnC,gBAAgB,QAAQ,iBAAiB;AAAA,IAC3C,CAAC;AACD,WAAO;AAAA,EACT;AAKA,SAAO,MAAM,MAAM,QAAQ,oBAAoB,SAAS;AAAA,IACtD;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAWA,eAAsB,iBACpB,QACA,SACA,WACA,QACc;AACd,QAAM,EAAE,IAAI,SAAS,UAAU,cAAc,KAAK,IAAI;AAEtD,MAAI,CAAC,MAAM,CAAC,SAAS;AACnB,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,iBAAe,MAAM;AAErB,SAAO,KAAK,+BAA+B,EAAE,WAAW,cAAc,QAAQ,CAAC;AAE/E,MAAI;AACJ,MAAI;AACF,mBAAe,UAAU,QAAkE,cAAc;AAAA,EAC3G,QAAQ;AACN,mBAAe;AAAA,EACjB;AAEA,MAAI,gBAAgB,OAAO,aAAa,SAAS,YAAY;AAC3D,UAAM;AAAA,MACJ,QAAQ;AAAA,QACN,aAAa,KAAK;AAAA,UAChB;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,MACA;AAAA,IACF;AACA,mBAAe,MAAM;AACrB,WAAO,EAAE,MAAM,MAAM,IAAI,SAAS,KAAK,eAAe;AAAA,EACxD;AAEA,SAAO,KAAK,kEAAkE,EAAE,WAAW,cAAc,QAAQ,CAAC;AAClH,SAAO,EAAE,MAAM,OAAO,WAAW,MAAM,IAAI,SAAS,KAAK,WAAW,QAAQ,mBAAmB;AACjG;AAWA,eAAsB,iBACpB,QACA,SACA,WACA,QACc;AACd,QAAM,EAAE,WAAW,QAAQ,IAAI;AAE/B,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAMA,MAAI,oCAAoC,SAAS,GAAG;AAClD,UAAM,IAAI,MAAM,uDAAuD,SAAS,GAAG;AAAA,EACrF;AAKA,QAAM,wBAAwB,2BAA2B,OAAO;AAChE,MAAI,sBAAsB,SAAS,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,kEAAkE,sBAAsB,KAAK,IAAI,CAAC;AAAA,IAEpG;AAAA,EACF;AAEA,iBAAe,MAAM;AAGrB,QAAM,WAAW,UAAU,QAA2G,UAAU;AAEhJ,MAAI,CAAC,YAAY,OAAO,SAAS,cAAc,YAAY;AACzD,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAGA,QAAM,kBAAkB;AAAA,IACtB,GAAG;AAAA,IACH,WAAW;AAAA,MACT,oBAAoB,QAAQ,iBAAiB;AAAA,MAC7C,YAAY,QAAQ,iBAAiB;AAAA,MACrC,UAAU,QAAQ,iBAAiB;AAAA,MACnC,gBAAgB,QAAQ,iBAAiB;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM;AAAA,IACJ,QAAQ;AAAA,MACN,SAAS,UAAU,WAAW,iBAAiB;AAAA,QAC7C,UAAU,QAAQ,iBAAiB;AAAA,QACnC,gBAAgB,QAAQ,iBAAiB;AAAA,MAC3C,CAAC;AAAA,IACH;AAAA,IACA;AAAA,EACF;AACA,iBAAe,MAAM;AAErB,SAAO,EAAE,SAAS,MAAM,WAAW,SAAS,gBAAgB;AAC9D;AAEA,MAAM,8BAA8B;AAEpC,SAAS,2BAA2B,OAAgB,OAAO,IAAc;AACvE,MAAI,OAAO,UAAU,UAAU;AAC7B,WAAO,4BAA4B,KAAK,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC7D;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,WAAO,MAAM,QAAQ,CAAC,MAAM,UAAU,2BAA2B,MAAM,GAAG,IAAI,IAAI,KAAK,GAAG,CAAC;AAAA,EAC7F;AACA,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,MAAQ,CAAC,CAAC,KAAK,MAAM,MAChD,2BAA2B,QAAQ,OAAO,GAAG,IAAI,IAAI,GAAG,KAAK,GAAG;AAAA,IAClE;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAiCA,eAAsB,oBACpB,IACA,QACA,SACA,WACA,QACc;AACd,QAAM,EAAE,WAAW,OAAO,iBAAiB,IAAI;AAE/C,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,2EAA2E;AAAA,EAC7F;AAGA,QAAM,sBAAsB,uBAAuB,SAAS;AAC5D,MAAI,CAAC,qBAAqB;AACxB,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAKA,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA,QAAQ,iBAAiB;AAAA,EAC3B;AACA,iBAAe,MAAM;AACrB,MAAI,CAAC,yBAAyB,qBAAqB,aAAa,GAAG;AACjE,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,MAAI,CAAC,SAAS,OAAO,UAAU,UAAU;AACvC,UAAM,IAAI,MAAM,wDAAwD;AAAA,EAC1E;AAEA,QAAM,cAAc,OAAO,QAAQ,WAAW,WAAW,QAAQ,OAAO,KAAK,IAAI;AACjF,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,uDAAuD;AAAA,EACzE;AAEA,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,oBAAoB;AAAA,IACpB,QAAQ,iBAAiB;AAAA,IACzB,QAAQ,iBAAiB;AAAA,EAC3B;AACA,iBAAe,MAAM;AACrB,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,yCAAyC;AAAA,EAC3D;AAGA,QAAM,aAAa,UAAU,QAAQ,YAAY;AAEjD,MAAI,CAAC,cAAc,OAAO,WAAW,YAAY,YAAY;AAC3D,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,QAAM,iBAAiB,2BAA2B,KAAK;AACvD,MAAI,eAAe,SAAS,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR,mEAAmE,eAAe,KAAK,IAAI,CAAC;AAAA,IAE9F;AAAA,EACF;AAGA,MAAI,aAAa,EAAE,GAAG,MAAM;AAG5B,MAAI,WAAW,eAAe,kBAAkB;AAC9C,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,QAAQ,iBAAiB;AAAA,MACzB,QAAQ,iBAAiB;AAAA,IAC3B;AACA,mBAAe,MAAM;AACrB,QAAI,eAAe;AACjB,iBAAW,gBAAgB;AAAA,IAC7B;AACA,WAAO,WAAW;AAAA,EACpB;AAGA,QAAM,MAAM;AAAA,IACV;AAAA,IACA,MAAM;AAAA,MACJ,KAAK;AAAA,MACL,UAAU,QAAQ,iBAAiB;AAAA,MACnC,OAAO,QAAQ,iBAAiB;AAAA,MAChC,cAAc;AAAA,IAChB;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,QAAQ,iBAAiB;AAAA,IACjD,iBAAiB,QAAQ,iBAAiB,iBACtC,CAAC,QAAQ,iBAAiB,cAAc,IACxC;AAAA,EACN;AAKA,iBAAe,MAAM;AACrB,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM;AAAA,IACjC,QAAQ;AAAA,MACN,WAAW,QAAQ,WAAW;AAAA,QAC5B,OAAO;AAAA,QACP;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA;AAAA,EACF;AACA,iBAAe,MAAM;AAErB,SAAO;AAAA,IACL,UAAU;AAAA,IACV;AAAA,IACA;AAAA,IACA,YAAY,UAAU;AAAA,EACxB;AACF;AAKA,eAAe,yBACb,IACA,eACA,OACA,UACA,gBACwB;AACxB,MAAI;AAEF,UAAM,EAAE,YAAY,gBAAgB,IAAI,MAAM,OAAO,uDAAuD;AAG5G,UAAM,aAAa,MAAM,GAAG,QAAQ,YAAY;AAAA,MAC9C,KAAK;AAAA,MACL;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AAED,QAAI,CAAC,YAAY;AACf,aAAO,KAAK,wBAAwB,EAAE,WAAW,iBAAiB,cAAc,CAAC;AACjF,aAAO;AAAA,IACT;AAGA,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,QAAQ,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAC9C,YAAY,WAAW;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAED,QAAI,CAAC,OAAO;AACV,aAAO,KAAK,8BAA8B,EAAE,WAAW,iBAAiB,eAAe,MAAM,CAAC;AAC9F,aAAO;AAAA,IACT;AAEA,WAAO,MAAM;AAAA,EACf,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,WAAW,iBAAiB,KAAK,MAAM,CAAC;AAC3F,WAAO;AAAA,EACT;AACF;AAgBA,eAAsB,mBACpB,QACA,SACA,OAAwB,CAAC,GACX;AACd,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OACzB,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AACA,QAAM,EAAE,KAAK,QAAQ,SAAS,YAAY,KAAK,IAAI,OAAO;AAC1D,QAAM,UAAU,cAAc,CAAC;AAE/B,QAAM,eAAe,KAAK,gBAAgB,yCAAyC;AAEnF,MAAI;AACJ,MAAI;AACF,eAAW,MAAM;AAAA,MACf;AAAA,MACA;AAAA,QACE;AAAA,QACA,SAAS;AAAA,UACP,gBAAgB;AAAA,UAChB,GAAG;AAAA,QACL;AAAA,QACA,MAAM,SAAS,UAAa,SAAS,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACnE,UAAU;AAAA,QACV,QAAQ,KAAK;AAAA,MACf;AAAA,MACA;AAAA,QACE,SAAS;AAAA,QACT;AAAA,QACA,YAAY,KAAK;AAAA,QACjB,WAAW,KAAK;AAAA,MAClB;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,iBAAiB,wBAAwB;AAC3C,YAAM,IAAI;AAAA,QACR,4CAA4C,MAAM,MAAM,MAAM,MAAM,OAAO;AAAA,MAC7E;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,MAAI,SAAS,UAAU,OAAO,SAAS,SAAS,KAAK;AACnD,UAAM,WAAW,SAAS,QAAQ,IAAI,UAAU;AAChD,UAAM,IAAI;AAAA,MACR,2CAA2C,SAAS,MAAM,OACxD,YAAY,sBACd;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACJ,QAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AAEvD,MAAI,eAAe,YAAY,SAAS,kBAAkB,GAAG;AAC3D,aAAS,MAAM,SAAS,KAAK;AAAA,EAC/B,OAAO;AACL,aAAS,MAAM,SAAS,KAAK;AAAA,EAC/B;AAGA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR,sCAAsC,SAAS,MAAM,KAAK,KAAK,UAAU,MAAM,CAAC;AAAA,IAClF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAQ,SAAS;AAAA,IACjB,YAAY,SAAS;AAAA,IACrB;AAAA,EACF;AACF;AASA,eAAsB,gBACpB,QACA,SACA,WACA,QACc;AACd,QAAM,EAAE,cAAc,OAAO,CAAC,EAAE,IAAI;AAEpC,MAAI,CAAC,cAAc;AACjB,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAEA,iBAAe,MAAM;AAGrB,QAAM,QAAQ,oBAAoB,YAAY;AAE9C,MAAI;AACF,UAAM,KAAK,UAAU,QAAQ,KAAK;AAElC,QAAI,OAAO,OAAO,YAAY;AAC5B,YAAM,IAAI,MAAM,iCAAiC,YAAY,qBAAqB;AAAA,IACpF;AAIA,UAAM,SAAS,MAAM;AAAA,MACnB,QAAQ,QAAQ,GAAG,MAAM,SAAS,MAAM,CAAC;AAAA,MACzC;AAAA,IACF;AACA,mBAAe,MAAM;AAErB,WAAO,EAAE,UAAU,MAAM,cAAc,OAAO;AAAA,EAChD,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,QAAQ,SAAS,gBAAgB,GAAG;AACtE,YAAM,IAAI;AAAA,QACR,sBAAsB,YAAY,0CAA0C,KAAK;AAAA,MACnF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAYA,eAAsB,YAAY,QAA2B;AAC3D,QAAM,aAAa,qBAAqB,MAAM;AAI9C,QAAM,MAAM,UAAU;AAEtB,SAAO,EAAE,QAAQ,MAAM,WAAW;AACpC;AAWA,eAAsB,mBACpB,QACA,SAC4B;AAC5B,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OACzB,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AAEA,aAAW,cAAc,OAAO,KAAK,aAAa;AAChD,UAAM,WAAW,oBAAoB,WAAW,IAAI;AACpD,QAAI,aAAa,MAAM;AACrB,YAAM,IAAI;AAAA,QACR,mGAAmG,WAAW,IAAI;AAAA,MACpH;AAAA,IACF;AACA,QAAI,SAAS,WAAW,GAAG;AACzB,YAAM,IAAI,MAAM,2CAA2C,WAAW,IAAI,GAAG;AAAA,IAC/E;AAAA,EACF;AAEA,SAAO,EAAE,aAAa,OAAO,KAAK,YAAY;AAChD;AAoDA,SAAS,8BACP,WACqC;AACrC,MAAI;AACF,WAAO,UAAU,QAAiC,qBAAqB;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,mBACpB,QACA,SACA,WACc;AACd,QAAM,SAAS,wBAAwB,UAAU,MAAM;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,SAAS,OAAO,MAAM,OACzB,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,KAAK,GAAG,KAAK,QAAQ,KAAK,MAAM,OAAO,EAAE,EACtE,KAAK,IAAI;AACZ,UAAM,IAAI,MAAM,gCAAgC,MAAM,EAAE;AAAA,EAC1D;AACA,QAAM,EAAE,SAAS,OAAO,UAAU,eAAe,SAAS,OAAO,IAAI,OAAO;AAS5E,QAAM,oBAAoB,yBAAyB,mBAAmB,QAAQ,CAAC,UAAU,KAAK,CAAC;AAI/F,QAAM,SAAS,8BAA8B,SAAS;AACtD,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,QAAM,SACJ,QAAQ,aAAa,UACrB,QAAQ,iBAAiB;AAS3B,QAAM,cAAc,UAAU,QAAiC,IAAI;AACnE,QAAM,kBAAkB,MAAM,+BAA+B,aAAa,QAAQ,gBAAgB;AAClG,MAAI,CAAC,iBAAiB;AACpB,UAAM,IAAI;AAAA,MACR,4DAA4D,QAAQ,iBAAiB,EAAE;AAAA,IAGzF;AAAA,EACF;AAQA,MAAI,QAAQ,kBAAkB;AAC5B,UAAM,UAAU,MAAM,OAAO,uBAAuB;AAAA,MAClD;AAAA,MACA;AAAA,MACA;AAAA,MACA,KAAK;AAAA,QACH,UAAU,QAAQ,iBAAiB;AAAA,QACnC,gBAAgB,QAAQ,iBAAiB;AAAA,QACzC,QAAQ;AAAA,QACR,oBAAoB,QAAQ,iBAAiB;AAAA,QAC7C;AAAA;AAAA;AAAA,QAGA,GAAI,QAAQ,iBAAiB,EAAE,cAAc,QAAQ,eAAe,IAAI,CAAC;AAAA,QACzE,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,QAC7B,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;AAAA,MAC3D;AAAA,IACF,CAAC;AACD,QAAI,QAAQ,SAAS,YAAY;AAC/B,aAAO,EAAE,MAAM,YAAY,SAAS,MAAM,QAAQ,KAAK;AAAA,IACzD;AACA,QAAI,QAAQ,SAAS,YAAY;AAC/B,aAAO,EAAE,MAAM,YAAY,SAAS,WAAW,QAAQ,WAAW,SAAS,QAAQ,QAAQ;AAAA,IAC7F;AACA,QAAI,QAAQ,SAAS,mBAAmB,QAAQ,SAAS,iBAAiB;AACxE,aAAO,EAAE,MAAM,QAAQ,MAAM,SAAS,YAAY,QAAQ,YAAY,iBAAiB,QAAQ,QAAQ;AAAA,IACzG;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB,QAAQ,EAAE,YAAY,yBAAyB;AAAA,IACjD;AAAA,EACF;AAEA,MAAI,CAAC,QAAQ,gBAAgB;AAC3B,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AAaA,QAAM,QAAQ,oBAAoB;AAClC,QAAM,MAAsC;AAAA,IAC1C,MAAM;AAAA,IACN,oBAAoB,QAAQ,iBAAiB;AAAA,IAC7C,kBAAkB,QAAQ,oBAAoB;AAAA,IAC9C,gBAAgB,QAAQ;AAAA,IACxB;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,OAAQ,SAAS,CAAC;AAAA,IAClB;AAAA,IACA,GAAI,gBAAgB,EAAE,cAAc,IAAI,CAAC;AAAA,IACzC,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC7B,GAAI,oBAAoB,EAAE,QAAQ,kBAAkB,IAAI,CAAC;AAAA,IACzD,UAAU,QAAQ,iBAAiB;AAAA,IACnC,gBAAgB,QAAQ,iBAAiB;AAAA,IACzC,QAAQ;AAAA,EACV;AACA,QAAM,QAAQ,MAAM,MAAM,QAAQ,KAAK,EAAE,SAAS,8BAA8B,CAAC;AAEjF,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,QAAQ,EAAE,YAAY,yBAAyB;AAAA,EACjD;AACF;AAYA,eAAsB,eACpB,IACA,QACA,SACA,WACA,QACc;AAEd,QAAM,qBAAqB,0BAA0B,QAAQ,SAAS,UAAU;AAEhF,QAAM;AAAA,IACJ;AAAA,IACA,SAAS;AAAA,IACT,UAAU,CAAC;AAAA,IACX;AAAA,IACA,sBAAsB;AAAA,EACxB,IAAI;AAGJ,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAGA,QAAM,UAAU,YAAY,QAAQ;AAGpC,QAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,uCAAuC;AAqBlF,QAAM,WAAW,UACd,QAAiC,IAAI,EACrC,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,MAAM,CAAC;AAsBnE,QAAM,kBAAkB,MAAM,sBAAsB,UAAU,QAAQ,gBAAgB;AAEtF,MAAI,gBAAgB,WAAW,GAAG;AAChC,UAAM,IAAI;AAAA,MACR,iEAAiE,QAAQ,iBAAiB,EAAE;AAAA,IAG9F;AAAA,EACF;AAGA,SAAO,MAAM;AAAA,IACX;AAAA,IACA;AAAA,MACE,MAAM,cAAc,QAAQ,iBAAiB,EAAE;AAAA,MAC/C,aAAa,6BAA6B,QAAQ,iBAAiB,UAAU,aAAa,QAAQ,iBAAiB,EAAE;AAAA,MACrH,UAAU,QAAQ,iBAAiB;AAAA,MACnC,gBAAgB,QAAQ,iBAAiB;AAAA,MACzC,OAAO;AAAA,MACP,WAAW;AAAA,IACb;AAAA,IACA,OAAO,iBAAiB;AAEtB,YAAM,iBAAyC;AAAA,QAC7C,gBAAgB;AAAA,QAChB,iBAAiB,UAAU,YAAY;AAAA,QACvC,eAAe,QAAQ,iBAAiB;AAAA,QACxC,qBAAqB,QAAQ,iBAAiB;AAAA,QAC9C,0BAA0B,QAAQ,iBAAiB;AAAA,QACnD,GAAG;AAAA,MACL;AAGA,YAAM,WAAW,MAAM,MAAM,SAAS;AAAA,QACpC;AAAA,QACA,SAAS;AAAA,QACT,MAAM,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACpC;AAAA,MACF,CAAC;AAGD,UAAI;AACJ,YAAM,cAAc,SAAS,QAAQ,IAAI,cAAc;AAEvD,UAAI;AACF,YAAI,eAAe,YAAY,SAAS,kBAAkB,GAAG;AAC3D,yBAAe,MAAM,SAAS,KAAK;AAAA,QACrC,OAAO;AACL,yBAAe,MAAM,SAAS,KAAK;AAAA,QACrC;AAAA,MACF,SAAS,OAAO;AACd,uBAAe;AAAA,MACjB;AAGA,UAAI,CAAC,SAAS,IAAI;AAChB,8BAAsB,SAAS,QAAQ,cAAc,OAAO;AAAA,MAC9D;AAGA,UAAI,uBAAuB,gBAAgB,OAAO,iBAAiB,UAAU;AAC3E,YAAI,aAAa,YAAY,aAAa,aAAa,QAAQ,iBAAiB,UAAU;AACxF,gBAAM,IAAI;AAAA,YACR,wCAAwC,QAAQ,iBAAiB,QAAQ,qBAAqB,aAAa,QAAQ;AAAA,UACrH;AAAA,QACF;AAAA,MACF;AAGA,aAAO;AAAA,QACL,QAAQ,SAAS;AAAA,QACjB,YAAY,SAAS;AAAA,QACrB,SAAS,OAAO,YAAY,SAAS,QAAQ,QAAQ,CAAC;AAAA,QACtD,MAAM;AAAA,QACN,eAAe;AAAA,QACf,UAAU,QAAQ,iBAAiB;AAAA,QACnC,gBAAgB,QAAQ,iBAAiB;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACF;AAcA,eAAe,4BACb,IACA,QACA,OACmB;AACnB,QAAM,EAAE,uBAAuB,mBAAmB,IAAI,MAAM,OAAO,0CAA0C;AAC7G,QAAM,EAAE,MAAM,UAAU,KAAK,IAAI,MAAM,OAAO,0BAA0B;AAExE,QAAM,OAAO,MAAM,sBAAsB,IAAI,MAAM;AAAA,IACjD,IAAI;AAAA,IACJ,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,KAAK;AACZ,MAAI,CAAC,KAAM,QAAO,CAAC;AAEnB,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,KAAK,IAAI,WAAW,KAAK;AAAA,IACjC,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB;AAAA,EACF;AACA,QAAM,UAAU,UACb,IAAI,CAAC,OAAa,OAAO,GAAG,SAAS,WAAW,GAAG,OAAO,GAAG,MAAM,EAAG,EACtE,OAAO,CAAC,OAA8B,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAEhF,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAElC,QAAM,cAAc,MAAM,mBAAmB,IAAI,MAAM;AAAA,IACrD,IAAI,EAAE,KAAK,QAAQ;AAAA,IACnB,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,GAAG,CAAC,GAAG,KAAK;AACZ,SAAO,YAAY,IAAI,CAAC,MAAW,EAAE,EAAY;AACnD;AAMA,eAAe,uBAAuB,IAAS,UAA+B;AAC5E,MAAI,CAAC,SAAS,aAAc,QAAO;AACnC,QAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,0CAA0C;AACzF,QAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,kBAAkB;AAC9D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,SAAS,cAAc,UAAU,SAAS,SAAS;AAAA,IACzD,CAAC;AAAA,IACD,EAAE,UAAU,SAAS,UAAU,gBAAgB,SAAS,eAAe;AAAA,EACzE;AACF;AAEA,eAAsB,sBACpB,IACA,UACmB;AACnB,MAAI,CAAC,SAAS,aAAc,QAAO,CAAC;AAEpC,QAAM,QAAQ,EAAE,UAAU,SAAS,UAAU,gBAAgB,SAAS,eAAe;AACrF,QAAM,aAAa,MAAM,uBAAuB,IAAI,QAAQ;AAM5D,MAAI,wBAAwB,UAAU,GAAG;AACvC,UAAM,kBAAkB,MAAM,yCAAyC,IAAI,YAAY,IAAI;AAC3F,WAAO,kBAAkB,4BAA4B,IAAI,iBAAiB,KAAK,IAAI,CAAC;AAAA,EACtF;AAQA,QAAM,kBAAkB,SAAS,UAAU,eAAe;AAC1D,MAAI,iBAAiB;AACnB,WAAO,4BAA4B,IAAI,iBAAiB,KAAK;AAAA,EAC/D;AAIA,QAAM,eAAe,YAAY,YAAY,OAAO,YAAY;AAChE,MAAI,CAAC,aAAc,QAAO,CAAC;AAE3B,SAAO,4BAA4B,IAAI,cAAc,KAAK;AAC5D;AAmBA,eAAsB,+BACpB,IACA,UACwB;AACxB,QAAM,aAAa,MAAM,uBAAuB,IAAI,QAAQ;AAI5D,MAAI,wBAAwB,UAAU,GAAG;AACvC,WAAO,yCAAyC,IAAI,YAAY,IAAI;AAAA,EACtE;AAEA,QAAM,kBAAkB,SAAS,UAAU,eAAe;AAC1D,MAAI,gBAAiB,QAAO;AAE5B,MAAI,YAAY,UAAW,QAAO;AAClC,SAAO,YAAY,aAAa;AAClC;AAOA,SAAS,YAAY,UAA0B;AAC7C,QAAM,SAAS,QAAQ,IAAI,WAAW;AAGtC,MAAI,SAAS,WAAW,GAAG,GAAG;AAE5B,QAAI,CAAC,SAAS,WAAW,OAAO,GAAG;AACjC,YAAM,IAAI,MAAM,6CAA6C,QAAQ,EAAE;AAAA,IACzE;AACA,WAAO,GAAG,MAAM,GAAG,QAAQ;AAAA,EAC7B;AAGA,MAAI;AACF,UAAM,cAAc,IAAI,IAAI,QAAQ;AACpC,UAAM,YAAY,IAAI,IAAI,MAAM;AAEhC,QAAI,YAAY,SAAS,UAAU,MAAM;AACvC,YAAM,IAAI;AAAA,QACR,8CAA8C,YAAY,IAAI,6BAA6B,UAAU,IAAI;AAAA,MAC3G;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,WAAW;AAC9B,YAAM,IAAI,MAAM,yBAAyB,QAAQ,EAAE;AAAA,IACrD;AACA,UAAM;AAAA,EACR;AACF;AAOA,SAAS,sBAAsB,QAAgB,MAAW,KAAoB;AAC5E,QAAM,UAAU,OAAO,SAAS,WAAW,OAAO,KAAK,UAAU,IAAI;AAErE,MAAI,UAAU,OAAO,SAAS,KAAK;AAEjC,UAAM,IAAI;AAAA,MACR,uCAAuC,MAAM,qBAAqB,OAAO;AAAA,IAC3E;AAAA,EACF;AAEA,MAAI,UAAU,KAAK;AAEjB,UAAM,QAAa,IAAI;AAAA,MACrB,uCAAuC,MAAM,iBAAiB,OAAO;AAAA,IACvE;AACA,UAAM,YAAY;AAClB,UAAM;AAAA,EACR;AAGA,QAAM,IAAI,MAAM,uCAAuC,MAAM,KAAK,OAAO,EAAE;AAC7E;AAYA,SAAS,8BACP,MACA,SACA,kBAC6B;AAC7B,MAAI,KAAK,WAAW,WAAW,KAAK,kBAAkB;AACpD,UAAM,cAAc,KAAK,UAAU,YAAY,MAAM;AACrD,YAAQ,aAAa;AAAA,MACnB,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,GAAG;AAAA,MAC1D,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,SAAS;AAAA,MAChE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,eAAe;AAAA,MACtE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,cAAc;AAAA,MACrE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,WAAW;AAAA,MAClE,KAAK;AACH,eAAO,EAAE,QAAQ,YAAY,OAAO,iBAAiB,QAAQ;AAAA,MAC/D;AACE,eAAO,EAAE,QAAQ,wBAAwB,YAAY;AAAA,IACzD;AAAA,EACF;AAEA,MAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,UAAM,SAAS,KAAK,UAAU,OAAO,MAAM;AAC3C,QAAI,CAAC,qCAAqC,EAAE,IAAI,MAAM,GAAG;AACvD,aAAO,EAAE,QAAQ,uBAAuB,OAAO;AAAA,IACjD;AACA,WAAO,EAAE,QAAQ,YAAY,OAAO,QAAQ,IAAI,MAAM,KAAK,GAAG;AAAA,EAChE;AAEA,MAAI,SAAS,OAAO;AAClB,WAAO,EAAE,QAAQ,YAAY,QAAO,oBAAI,KAAK,GAAE,YAAY,EAAE;AAAA,EAC/D;AAEA,QAAM,cAAc,KAAK,WAAW,UAAU,IAAI,KAAK,UAAU,WAAW,MAAM,IAAI;AACtF,QAAM,QAAQ,eAAe,SAAS,WAAW;AACjD,MAAI,UAAU,OAAW,QAAO,EAAE,QAAQ,YAAY,MAAM;AAC5D,SAAO,EAAE,QAAQ,sBAAsB,YAAY;AACrD;AAEA,SAAS,yBAAyB,UAAkB,QAA4C;AAC9F,SAAO,IAAI;AAAA,IACT,wBAAwB,QAAQ,OAAO,MAAM;AAAA,IAC7C;AAAA,EACF;AACF;AAEA,SAAS,iBACP,UACA,SACA,kBACA,QACwC;AACxC,QAAM,cAAc,wBAAwB,QAAQ;AACpD,MAAI,CAAC,YAAY,IAAI;AACnB,QAAI,OAAQ,OAAM,yBAAyB,UAAU,YAAY,KAAK;AACtE,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,QAAM,aAAa,8BAA8B,YAAY,MAAM,SAAS,gBAAgB;AAC5F,MAAI,WAAW,WAAW,wBAAwB;AAChD,QAAI,OAAQ,OAAM,yBAAyB,UAAU,yBAAyB,WAAW,WAAW,GAAG;AACvG,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,uBAAuB;AAC/C,QAAI,OAAQ,OAAM,yBAAyB,UAAU,iBAAiB,WAAW,MAAM,sBAAsB;AAAA,EAC/G;AACA,QAAM,YACJ,WAAW,WAAW,aAClB,WAAW,QACX,WAAW,WAAW,wBACpB,KACA;AACR,MAAI,YAAY,WAAW,WAAW,GAAG;AACvC,QAAI,WAAW,WAAW,sBAAsB;AAC9C,UAAI,OAAQ,OAAM,yBAAyB,UAAU,iBAAiB,WAAW,WAAW,kBAAkB;AAC9G,aAAO,EAAE,UAAU,MAAM;AAAA,IAC3B;AACA,WAAO,EAAE,UAAU,MAAM,OAAO,UAAU;AAAA,EAC5C;AACA,QAAM,cAAc,gBAAgB,WAAW,YAAY,UAAU;AACrE,MAAI,CAAC,YAAY,IAAI;AACnB,QAAI,OAAQ,OAAM,yBAAyB,UAAU,YAAY,MAAM,OAAO;AAC9E,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,MAAI,YAAY,UAAU,QAAW;AACnC,QAAI,OAAQ,OAAM,yBAAyB,UAAU,0CAA0C;AAC/F,WAAO,EAAE,UAAU,MAAM;AAAA,EAC3B;AACA,SAAO,EAAE,UAAU,MAAM,OAAO,YAAY,MAAM;AACpD;AAsBO,SAAS,qBACd,QACA,SACA,kBACA,SACK;AACL,QAAM,SAAS,SAAS,SAAS;AACjC,MAAI,OAAO,WAAW,UAAU;AAG9B,UAAM,iBAAiB,OAAO,MAAM,mBAAmB;AAEvD,QAAI,gBAAgB;AAClB,YAAM,UAAU,iBAAiB,eAAe,CAAC,GAAG,SAAS,kBAAkB,MAAM;AACrF,aAAO,QAAQ,WAAW,QAAQ,QAAQ;AAAA,IAC5C;AAGA,WAAO,OAAO,QAAQ,oBAAoB,CAAC,OAAO,UAAU;AAC1D,YAAM,UAAU,iBAAiB,OAAO,SAAS,kBAAkB,MAAM;AACzE,aAAO,QAAQ,WAAW,OAAO,QAAQ,KAAK,IAAI;AAAA,IACpD,CAAC;AAAA,EACH;AAEA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO,OAAO,IAAI,CAAC,SAAS,qBAAqB,MAAM,SAAS,kBAAkB,OAAO,CAAC;AAAA,EAC5F;AAEA,MAAI,UAAU,OAAO,WAAW,UAAU;AACxC,UAAM,SAA8B,CAAC;AACrC,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,aAAO,GAAG,IAAI,qBAAqB,OAAO,SAAS,kBAAkB,OAAO;AAAA,IAC9E;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAEA,SAAS,0BACP,QACA,SACA,cACA,cACK;AACL,MAAI;AACF,WAAO,qBAAqB,QAAQ,QAAQ,iBAAiB,QAAQ,kBAAkB;AAAA,MACrF,MAAM,QAAQ;AAAA,IAChB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,4BAA4B;AAC/C,YAAM,IAAI,uBAAuB,MAAM,SAAS,cAAc,cAAc,EAAE,OAAO,MAAM,MAAM,CAAC;AAAA,IACpG;AACA,UAAM;AAAA,EACR;AACF;AAKA,SAAS,eAAe,KAAU,MAAmB;AACnD,QAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,MAAI,QAAQ;AAEZ,aAAW,QAAQ,OAAO;AACxB,QAAI,SAAS,OAAO,UAAU,YAAY,QAAQ,OAAO;AACvD,cAAQ,MAAM,IAAI;AAAA,IACpB,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAKA,SAAS,iBACP,mBACA,oBACA,SACA,eACQ;AACR,QAAM,UAAU,oBAAoB,KAAK,IAAI,oBAAoB,OAAO;AACxE,SAAO,KAAK,IAAI,SAAS,iBAAiB,QAAQ;AACpD;AAKA,SAAS,MAAM,IAA2B;AACxC,SAAO,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,EAAE,CAAC;AACzD;AAcA,eAAe,mBACb,UACA,WACY;AACZ,MAAI;AACJ,QAAM,kBAAkB,IAAI,gBAAgB;AAE5C,QAAM,iBAAiB,IAAI,QAAe,CAAC,GAAG,WAAW;AACvD,gBAAY,WAAW,MAAM;AAC3B,sBAAgB,MAAM;AACtB,aAAO,IAAI,MAAM,oCAAoC,SAAS,IAAI,CAAC;AAAA,IACrE,GAAG,SAAS;AAAA,EACd,CAAC;AAED,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,gBAAgB,MAAM,GAAG,cAAc,CAAC;AAAA,EAC9E,UAAE;AACA,iBAAa,SAAU;AAAA,EACzB;AACF;AAEA,SAAS,yBAAyB,QAA6B;AAC7D,MAAI,QAAQ,kBAAkB,MAAO,QAAO,OAAO;AACnD,MAAI;AACF,WAAO,IAAI,aAAa,6BAA6B,YAAY;AAAA,EACnE,QAAQ;AACN,UAAM,QAAQ,IAAI,MAAM,2BAA2B;AACnD,UAAM,OAAO;AACb,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eAAe,QAA4B;AAClD,MAAI,QAAQ,SAAS;AACnB,UAAM,yBAAyB,MAAM;AAAA,EACvC;AACF;AAOA,SAAS,cAAiB,SAAqB,QAAkC;AAC/E,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI,OAAO,SAAS;AAClB,WAAO,QAAQ,OAAO,yBAAyB,MAAM,CAAC;AAAA,EACxD;AACA,SAAO,IAAI,QAAW,CAAC,SAAS,WAAW;AACzC,UAAM,UAAU,MAAM;AACpB,aAAO,yBAAyB,MAAM,CAAC;AAAA,IACzC;AACA,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,YAAQ;AAAA,MACN,CAAC,UAAU;AACT,eAAO,oBAAoB,SAAS,OAAO;AAC3C,gBAAQ,KAAK;AAAA,MACf;AAAA,MACA,CAAC,UAAU;AACT,eAAO,oBAAoB,SAAS,OAAO;AAC3C,eAAO,KAAK;AAAA,MACd;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,qBAAqB;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;",
   "names": ["calculateWaitDelayMs"]
 }

package/dist/modules/workflows/lib/activity-types.js

@@ -112,7 +112,7 @@ function registerBuiltinActivityTypes() {
       { id: "template", component: "text" },
       { id: "body", component: "textarea" }
     ],
-    execute: async (config, ctx, deps) => (await loadExecutor()).executeSendEmail(config, ctx, deps.container),
+    execute: async (config, ctx, deps) => (await loadExecutor()).executeSendEmail(config, ctx, deps.container, deps.signal),
     async: { capable: true },
     mock: (config) => {
       const record = asConfigRecord(config);
@@ -128,7 +128,7 @@ function registerBuiltinActivityTypes() {
       { id: "eventName", component: "eventName", required: true },
       { id: "payload", component: "json" }
     ],
-    execute: async (config, ctx, deps) => (await loadExecutor()).executeEmitEvent(config, ctx, deps.container),
+    execute: async (config, ctx, deps) => (await loadExecutor()).executeEmitEvent(config, ctx, deps.container, deps.signal),
     async: { capable: true },
     mock: (config) => {
       const record = asConfigRecord(config);
@@ -150,7 +150,7 @@ function registerBuiltinActivityTypes() {
       { id: "input", component: "json", required: true },
       { id: "statusDictionary", component: "text" }
     ],
-    execute: async (config, ctx, deps) => (await loadExecutor()).executeUpdateEntity(deps.em, config, ctx, deps.container),
+    execute: async (config, ctx, deps) => (await loadExecutor()).executeUpdateEntity(deps.em, config, ctx, deps.container, deps.signal),
     async: { capable: true },
     outputContract: resolveCommandOutputContract,
     mock: (config) => {
@@ -195,7 +195,7 @@ function registerBuiltinActivityTypes() {
       },
       { id: "args", component: "json" }
     ],
-    execute: async (config, ctx, deps) => (await loadExecutor()).executeFunction(config, ctx, deps.container),
+    execute: async (config, ctx, deps) => (await loadExecutor()).executeFunction(config, ctx, deps.container, deps.signal),
     async: { capable: true },
     mock: "refuse"
   });