@fabricorg/platform-host 2.0.0 → 3.0.0

package/dist/index.cjs

@@ -1,11 +1,68 @@
 'use strict';
 
 var platform = require('@fabricorg/platform');
+var crypto = require('crypto');
 
 // src/host.ts
 
 // src/types.ts
 var PLATFORM_HOST_CONTRACT_VERSION = 2;
+var IdempotencyConflictError = class extends Error {
+  constructor(conflict) {
+    super(`Idempotency key "${conflict.idempotencyKey}" conflicts with invocation ${conflict.existingInvocationId}: ${conflict.reasons.join(", ")}`);
+    this.conflict = conflict;
+    this.name = "IdempotencyConflictError";
+  }
+  conflict;
+  code = "IDEMPOTENCY_CONFLICT";
+};
+var PARAMETER_DIGEST_ALGORITHM = "fabric-canonical-json-sha256-v1";
+function canonicalJson(value) {
+  return JSON.stringify(sort(value));
+}
+function sort(value) {
+  if (Array.isArray(value)) return value.map(sort);
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, sort(child)]));
+  }
+  return value;
+}
+function digestParameters(parameters) {
+  return crypto.createHash("sha256").update(canonicalJson(parameters)).digest("hex");
+}
+var ATTRIBUTE_NAME = /^[a-z][a-z0-9-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)+$/;
+var INVOCATION_SOURCES = /* @__PURE__ */ new Set(["sdui", "api", "agent", "worker", "system"]);
+function normalizeProvenance(input, options) {
+  if (!input) return void 0;
+  if (!INVOCATION_SOURCES.has(input.source)) throw new Error(`Invalid invocation provenance source: ${input.source}`);
+  const maxAttributes = options?.maxAttributes ?? 16;
+  const maxValueLength = options?.maxValueLength ?? 256;
+  const allowlist = new Set(options?.auditAttributeAllowlist ?? []);
+  const validate = (attributes, durable) => {
+    if (!attributes) return void 0;
+    const entries = Object.entries(attributes);
+    if (entries.length > maxAttributes) throw new Error(`Invocation provenance exceeds ${maxAttributes} attributes.`);
+    for (const [key, value] of entries) {
+      if (!ATTRIBUTE_NAME.test(key)) throw new Error(`Invalid provenance attribute name: ${key}`);
+      if (value.length > maxValueLength) throw new Error(`Invocation provenance attribute "${key}" exceeds ${maxValueLength} characters.`);
+      if (durable && !allowlist.has(key)) throw new Error(`Audit provenance attribute "${key}" is not allowlisted.`);
+    }
+    return Object.fromEntries(entries);
+  };
+  validate(input.traceAttributes, false);
+  const redactedAuditAttributes = input.auditAttributes ? options?.redactAuditAttributes?.({ ...input.auditAttributes }) ?? input.auditAttributes : void 0;
+  const auditAttributes = validate(redactedAuditAttributes, true);
+  options?.onTrace?.({
+    ...input,
+    ...auditAttributes ? { auditAttributes } : { auditAttributes: void 0 }
+  });
+  return {
+    source: input.source,
+    correlationId: input.correlationId,
+    ...input.causationId ? { causationId: input.causationId } : {},
+    ...auditAttributes ? { auditAttributes } : {}
+  };
+}
 
 // src/host.ts
 var DEFAULT_EXTRACT_EVENTS = (data) => {
@@ -29,6 +86,9 @@ function createGovernedActionHost(options) {
   const actionResolver = options.resolveAction ?? platform.resolveAction;
   const eventResultFields = options.eventResultFields ?? ["_events"];
   async function submitAction(input) {
+    if (input.executionReason && !["initial", "offline_replay"].includes(input.executionReason)) {
+      throw new Error(`Unsupported submitted execution reason: ${input.executionReason}`);
+    }
     const action = actionResolver(input.actionId);
     if (!action) throw new Error(`Unknown action: ${input.actionId}`);
     const authorizationInput = toAuthorizationInput(action, input);
@@ -39,8 +99,16 @@ function createGovernedActionHost(options) {
       throw new Error(`Actor ${input.actorId} is not authorized for action ${input.actionId}`);
     }
     const actionInvocationId = platform.createFabricId("act");
-    const correlationId = input.correlationId ?? platform.createFabricId("corr");
+    if (input.correlationId && input.provenance?.correlationId && input.correlationId !== input.provenance.correlationId) throw new Error("Invocation provenance correlationId does not match submission correlationId.");
+    if (input.causationId && input.provenance?.causationId && input.causationId !== input.provenance.causationId) throw new Error("Invocation provenance causationId does not match submission causationId.");
+    const correlationId = input.correlationId ?? input.provenance?.correlationId ?? platform.createFabricId("corr");
     const durableParameters = options.redactActionParameters ? options.redactActionParameters(input.actionId, input.parameters) : input.parameters;
+    const parameterDigest = digestParameters(input.parameters);
+    if (input.authorizationBinding) validateAuthorizationBinding(input, parameterDigest, action.execution?.authorityMoment, now());
+    const durableProvenance = normalizeProvenance(
+      input.provenance,
+      options.provenance
+    );
     const runtimeEvidence = {
       governanceContractVersion: platform.FABRIC_GOVERNANCE_CONTRACT_VERSION,
       hostContractVersion: PLATFORM_HOST_CONTRACT_VERSION,
@@ -60,12 +128,41 @@ function createGovernedActionHost(options) {
       result: {},
       runtimeEvidence,
       correlationId,
-      ...input.causationId ? { causationId: input.causationId } : {},
+      ...input.causationId ?? input.provenance?.causationId ? { causationId: input.causationId ?? input.provenance?.causationId } : {},
       ...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
+      ...input.idempotencyKey ? {
+        parameterDigest,
+        parameterDigestAlgorithm: PARAMETER_DIGEST_ALGORITHM,
+        idempotencyActorId: input.actorId,
+        ...input.authorizationBindingId ? { idempotencyAuthorizationBindingId: input.authorizationBindingId } : {}
+      } : {},
+      ...durableProvenance ? { provenance: durableProvenance } : {},
+      ...input.authorizationBinding ? { authorizationBinding: input.authorizationBinding } : {},
+      ...input.executionReason ? { executionReason: input.executionReason } : {},
       ...input.authorizationBindingId ? { authorizationBindingId: input.authorizationBindingId } : {}
     });
+    if (durableInvocation.id !== actionInvocationId && input.idempotencyKey) {
+      const conflict = idempotencyConflict(durableInvocation, {
+        actorId: input.actorId,
+        authorizationBindingId: input.authorizationBindingId,
+        actionVersion: action.version,
+        parameterDigest,
+        idempotencyKey: input.idempotencyKey
+      });
+      if (!durableInvocation.parameterDigest) {
+        options.idempotency?.onLegacyRecord?.(durableInvocation);
+        const enforceableLegacyConflict = conflict && { ...conflict, reasons: conflict.reasons.filter((reason) => reason !== "parameters") };
+        if (enforceableLegacyConflict && enforceableLegacyConflict.reasons.length) {
+          options.idempotency?.onConflict?.(enforceableLegacyConflict);
+          if ((options.idempotency?.conflictMode ?? "enforce") === "enforce") throw new IdempotencyConflictError(enforceableLegacyConflict);
+        }
+      } else if (conflict) {
+        options.idempotency?.onConflict?.(conflict);
+        if ((options.idempotency?.conflictMode ?? "enforce") === "enforce") throw new IdempotencyConflictError(conflict);
+      }
+    }
     const durableWorkflowId = `action-invocation-${durableInvocation.id}`;
-    if (durableInvocation.id !== actionInvocationId && isTerminal(durableInvocation.status)) {
+    if (durableInvocation.id !== actionInvocationId) {
       return {
         actionInvocationId: durableInvocation.id,
         status: durableInvocation.status,
@@ -73,7 +170,8 @@ function createGovernedActionHost(options) {
         result: durableInvocation.result,
         ...durableInvocation.error ? { error: durableInvocation.error } : {},
         ...durableInvocation.hitlRoute ? { hitlRoute: durableInvocation.hitlRoute } : {},
-        ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {}
+        ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {},
+        ...durableInvocation.authorizationReconciliation ? { reconciliation: durableInvocation.authorizationReconciliation } : {}
       };
     }
     if (options.dispatcher) {
@@ -221,7 +319,7 @@ function createGovernedActionHost(options) {
         }
       }
       const authorizationInput = toAuthorizationInput(action, invocation);
-      const executionReason = executionReasonOverride ?? (invocation.attemptCount > 1 || resumingRunningInvocation && invocation.attemptCount === 0 ? "recovery" : "initial");
+      const executionReason = executionReasonOverride ?? (invocation.attemptCount > 1 || resumingRunningInvocation && invocation.attemptCount === 0 ? "recovery" : invocation.executionReason ?? "initial");
       if (!await options.authorization.checkEntitlement(authorizationInput)) {
         return fail(
           invocation,
@@ -229,7 +327,32 @@ function createGovernedActionHost(options) {
           `Module "${action.namespace}" is no longer enabled for tenant ${tenantId}`
         );
       }
-      const executionAuthorized = options.authorization.authorizeExecution ? await options.authorization.authorizeExecution({
+      const authorityMoment = action.execution?.authorityMoment;
+      if (authorityMoment === "capture" && !invocation.authorizationBinding) {
+        const reconciliation = {
+          kind: "authorization_missing_capture_evidence",
+          governingMoment: authorityMoment,
+          executionReason,
+          ...invocation.provenance ? { provenance: invocation.provenance } : {},
+          message: `Action ${action.actionId} requires durable capture-time authorization evidence`
+        };
+        await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
+        return { actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation };
+      }
+      const bindingExpired = authorityMoment !== "capture" && invocation.authorizationBinding?.expiresAt !== void 0 && Date.parse(invocation.authorizationBinding.expiresAt) <= now().getTime();
+      if (bindingExpired) {
+        const reconciliation = {
+          kind: "authorization_expired",
+          governingMoment: authorityMoment ?? "both",
+          executionReason,
+          ...invocation.authorizationBindingId ? { authorizationBindingId: invocation.authorizationBindingId } : {},
+          ...invocation.provenance ? { provenance: invocation.provenance } : {},
+          message: `Authorization binding for action ${action.actionId} expired before execution`
+        };
+        await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
+        return { actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation };
+      }
+      const executionAuthorized = authorityMoment === "capture" ? invocation.authorizationBinding !== void 0 : options.authorization.authorizeExecution ? await options.authorization.authorizeExecution({
         ...authorizationInput,
         actionInvocationId,
         parameters: parsed.data,
@@ -237,11 +360,19 @@ function createGovernedActionHost(options) {
         executionReason
       }) : await options.authorization.authorize(authorizationInput);
       if (!executionAuthorized) {
-        return fail(
-          invocation,
-          "failed",
-          `Actor ${invocation.actorId} is not authorized to execute action ${action.actionId}`
-        );
+        if (!action.execution) {
+          return fail(invocation, "failed", `Actor ${invocation.actorId} is not authorized to execute action ${action.actionId}`);
+        }
+        const reconciliation = {
+          kind: "authorization_denied",
+          governingMoment: action.execution?.authorityMoment ?? "both",
+          executionReason,
+          ...invocation.authorizationBindingId ? { authorizationBindingId: invocation.authorizationBindingId } : {},
+          ...invocation.provenance ? { provenance: invocation.provenance } : {},
+          message: `Actor ${invocation.actorId} is not authorized to execute action ${action.actionId}`
+        };
+        await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { status: "reconciliation_required", error: reconciliation.message, authorizationReconciliation: reconciliation });
+        return { actionInvocationId, status: "reconciliation_required", error: reconciliation.message, reconciliation };
       }
       const definitions = options.resolvePolicies ? await options.resolvePolicies({
         ...authorizationInput,
@@ -328,6 +459,9 @@ function createGovernedActionHost(options) {
       let domainEvents = [];
       try {
         const runHandler = async (db, transaction) => {
+          if (options.outbox && !transaction?.appendEventWithOutbox) {
+            throw new Error("Outbox egress requires transactionWithEvents to provide appendEventWithOutbox before handler execution.");
+          }
           const handlerResult = action.handler ? await action.handler(
             {
               actionInvocationId,
@@ -337,6 +471,7 @@ function createGovernedActionHost(options) {
               actorType: invocation.actorType,
               correlationId: invocation.correlationId,
               ...invocation.causationId ? { causationId: invocation.causationId } : {},
+              ...invocation.provenance ? { provenance: invocation.provenance } : {},
               db,
               services: options.services
             },
@@ -691,13 +826,22 @@ function createGovernedActionHost(options) {
       occurredAt: timestamp,
       recordedAt: timestamp,
       correlationId: invocation.correlationId,
-      ...invocation.causationId ? { causationId: invocation.causationId } : {}
+      ...invocation.causationId ? { causationId: invocation.causationId } : {},
+      ...invocation.provenance ? { provenance: { source: invocation.provenance.source, ...invocation.provenance.auditAttributes ? { auditAttributes: invocation.provenance.auditAttributes } : {} } } : {}
     };
     if (options.outbox) {
+      const hostLifecycleEvent = (/* @__PURE__ */ new Set(["AdapterInvocationStarted", "AdapterInvocationSucceeded", "AdapterInvocationFailed", "ComplianceBlocked"])).has(envelope.eventType);
+      const shouldPublish = options.outbox.shouldPublish?.(envelope) ?? !hostLifecycleEvent;
+      if (!shouldPublish) {
+        await (transaction ?? options.store).appendEvent(envelope);
+        return;
+      }
       const traceContext = options.outbox.traceContext?.(envelope);
+      const payloadClassification = options.outbox.classifyPayload(envelope);
       const metadata = {
         producerModuleVersion: options.outbox.producerModuleVersion(invocation.actionId, invocation.actionVersion),
-        payloadClassification: options.outbox.classifyPayload(envelope),
+        payloadClassification,
+        includeProvenance: options.outbox.includeProvenance?.(envelope, payloadClassification) ?? payloadClassification !== "restricted",
         ...traceContext ? { traceContext } : {}
       };
       if (transaction) {
@@ -736,7 +880,8 @@ function actionResult(invocation) {
     result: invocation.result,
     ...invocation.error ? { error: invocation.error } : {},
     ...invocation.hitlRoute ? { hitlRoute: invocation.hitlRoute } : {},
-    ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {}
+    ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {},
+    ...invocation.authorizationReconciliation ? { reconciliation: invocation.authorizationReconciliation } : {}
   };
 }
 function asApprovalStore(store) {
@@ -789,7 +934,7 @@ function initialState(entityType) {
   return Object.values(machine?.states ?? {}).find((state) => state.stateClass === "initial")?.id ?? "none";
 }
 function isTerminal(status) {
-  return ["completed", "failed", "blocked_by_policy", "validation_failed"].includes(status);
+  return ["completed", "failed", "blocked_by_policy", "reconciliation_required", "validation_failed"].includes(status);
 }
 function withoutPrivateHostFields(data, eventResultFields) {
   return Object.fromEntries(
@@ -806,6 +951,30 @@ function lifecycleId(prefix, invocationId, key) {
   const safeKey = key.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 96);
   return `${prefix}_${invocationId}_${safeKey}`;
 }
+function validateAuthorizationBinding(input, parameterDigest, authorityMoment, currentTime = /* @__PURE__ */ new Date()) {
+  const binding = input.authorizationBinding;
+  if (binding.id !== input.authorizationBindingId && input.authorizationBindingId) throw new Error("Authorization binding ID does not match authorizationBindingId.");
+  if (binding.tenantId !== input.tenantId || binding.actorId !== input.actorId || binding.actionId !== input.actionId || binding.parameterDigest !== parameterDigest) {
+    throw new Error("Authorization binding does not match the submitted command identity.");
+  }
+  if (authorityMoment && binding.governingMoment !== authorityMoment) throw new Error("Authorization binding governingMoment does not match the action execution contract.");
+  const capturedAt = Date.parse(binding.capturedAt);
+  const expiresAt = binding.expiresAt === void 0 ? void 0 : Date.parse(binding.expiresAt);
+  if (!Number.isFinite(capturedAt) || expiresAt !== void 0 && !Number.isFinite(expiresAt)) {
+    throw new Error("Authorization binding timestamps must be valid ISO-8601 values.");
+  }
+  if (expiresAt !== void 0 && (expiresAt <= capturedAt || authorityMoment === "capture" && expiresAt <= currentTime.getTime())) {
+    throw new Error("Authorization binding must be unexpired at capture and expire after capturedAt.");
+  }
+}
+function idempotencyConflict(existing, incoming) {
+  const reasons = [];
+  if ((existing.idempotencyActorId ?? existing.actorId) !== incoming.actorId) reasons.push("actor");
+  if ((existing.idempotencyAuthorizationBindingId ?? existing.authorizationBindingId) !== incoming.authorizationBindingId) reasons.push("authority_binding");
+  if (existing.actionVersion !== incoming.actionVersion) reasons.push("action_version");
+  if (existing.parameterDigest !== incoming.parameterDigest) reasons.push("parameters");
+  return reasons.length ? { code: "IDEMPOTENCY_CONFLICT", idempotencyKey: incoming.idempotencyKey, existingInvocationId: existing.id, reasons } : void 0;
+}
 
 // src/outbox.ts
 function toEnterpriseEventEnvelope(event, metadata) {
@@ -826,6 +995,7 @@ function toEnterpriseEventEnvelope(event, metadata) {
     producerModuleVersion: metadata.producerModuleVersion,
     payloadClassification: metadata.payloadClassification,
     ...metadata.traceContext ? { traceContext: { ...metadata.traceContext } } : {},
+    ...metadata.includeProvenance && event.provenance ? { provenance: event.provenance } : {},
     payload: event.payload
   };
 }
@@ -849,13 +1019,13 @@ async function runOutboxRelayCycle(options) {
         continue;
       }
       result.published += 1;
-    } catch (error) {
+    } catch {
       const deadLetter = record.attemptCount >= maxAttempts;
       try {
         await options.store.markOutboxFailed({
           id: record.id,
           workerId: options.workerId,
-          error: error instanceof Error ? error.message : String(error),
+          error: "Event publisher failed",
           availableAt: new Date(now().getTime() + (options.retryDelayMs?.(record.attemptCount) ?? 1e3)),
           deadLetter
         });
@@ -876,10 +1046,14 @@ function cloneOutboxRecord(record) {
 
 // src/memory-store.ts
 var MemoryPlatformHostStore = class {
-  constructor(db) {
+  constructor(db, transactionProvider) {
     this.db = db;
+    this.transactionalOutbox = transactionProvider !== void 0;
+    if (transactionProvider) this.transactionWithEvents = (run) => this.runTransactionWithEvents(run, transactionProvider);
   }
   db;
+  transactionalOutbox;
+  transactionTail = Promise.resolve();
   invocations = [];
   policyEvaluations = [];
   adapterInvocations = [];
@@ -891,6 +1065,50 @@ var MemoryPlatformHostStore = class {
   async transaction(run) {
     return run(this.db);
   }
+  async runTransactionWithEvents(run, transactionProvider) {
+    let release;
+    const previous = this.transactionTail;
+    this.transactionTail = new Promise((resolve) => {
+      release = resolve;
+    });
+    await previous;
+    let domainSnapshot;
+    let snapshotCreated = false;
+    try {
+      domainSnapshot = transactionProvider.snapshot(this.db);
+      snapshotCreated = true;
+      const pendingEvents = [];
+      const pendingUpdates = [];
+      const appendPending = async (event, metadata) => {
+        if (this.events.some((candidate) => candidate.id === event.id) || pendingEvents.some((candidate) => candidate.event.id === event.id)) return;
+        pendingEvents.push({ event, ...metadata ? { metadata } : {} });
+      };
+      const result = await run({
+        db: this.db,
+        appendEvent: (event) => appendPending(event),
+        appendEventWithOutbox: (event, metadata) => appendPending(event, metadata),
+        nextEventSequence: async (tenantId, spaceId) => (await this.listEvents(tenantId, spaceId)).length + pendingEvents.filter((candidate) => candidate.event.tenantId === tenantId && candidate.event.spaceId === spaceId).length + 1,
+        listEvents: async (tenantId, spaceId) => [...await this.listEvents(tenantId, spaceId), ...pendingEvents.map((candidate) => candidate.event).filter((event) => event.tenantId === tenantId && event.spaceId === spaceId)],
+        updateActionInvocation: async (id, tenantId, spaceId, patch) => {
+          pendingUpdates.push({ id, tenantId, spaceId, patch });
+        }
+      });
+      for (const update of pendingUpdates) {
+        if (!await this.getActionInvocation(update.id, update.tenantId, update.spaceId)) throw new Error(`ActionInvocation not found: ${update.id}`);
+      }
+      for (const pending of pendingEvents) {
+        if (pending.metadata) await this.appendEventWithOutbox(pending.event, pending.metadata);
+        else await this.appendEvent(pending.event);
+      }
+      for (const update of pendingUpdates) await this.updateActionInvocation(update.id, update.tenantId, update.spaceId, update.patch);
+      return result;
+    } catch (error) {
+      if (snapshotCreated) transactionProvider.restore(this.db, domainSnapshot);
+      throw error;
+    } finally {
+      release();
+    }
+  }
   async createActionInvocation(input) {
     if (input.idempotencyKey) {
       const existing = this.invocations.find(
@@ -912,7 +1130,7 @@ var MemoryPlatformHostStore = class {
     const record = await this.getActionInvocation(id, tenantId, spaceId);
     if (!record) throw new Error(`ActionInvocation not found: ${id}`);
     Object.assign(record, patch, { updatedAt: /* @__PURE__ */ new Date() });
-    if (patch.status === "waiting_for_approval" || patch.status === "completed" || patch.status === "failed" || patch.status === "blocked_by_policy" || patch.status === "validation_failed") {
+    if (patch.status === "waiting_for_approval" || patch.status === "completed" || patch.status === "failed" || patch.status === "blocked_by_policy" || patch.status === "reconciliation_required" || patch.status === "validation_failed") {
       delete record.leaseOwner;
       delete record.leaseExpiresAt;
     }
@@ -1124,6 +1342,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				actor_id text NOT NULL, actor_type text NOT NULL, status text NOT NULL,
 				parameters jsonb NOT NULL, result jsonb NOT NULL DEFAULT '{}'::jsonb,
 				correlation_id text NOT NULL, causation_id text, idempotency_key text,
+				parameter_digest text, parameter_digest_algorithm text, idempotency_actor_id text,
+				idempotency_authorization_binding_id text, invocation_provenance jsonb,
+				authorization_binding jsonb, execution_reason text, authorization_reconciliation jsonb,
 				authorization_binding_id text, error text,
 				attempt_count integer NOT NULL DEFAULT 0, lease_owner text,
 				lease_expires_at timestamptz, hitl_route text, hitl_risk_tier text,
@@ -1133,6 +1354,14 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			);
 			ALTER TABLE fabric_platform.action_invocations
 				ADD COLUMN IF NOT EXISTS idempotency_key text,
+				ADD COLUMN IF NOT EXISTS parameter_digest text,
+				ADD COLUMN IF NOT EXISTS parameter_digest_algorithm text,
+				ADD COLUMN IF NOT EXISTS idempotency_actor_id text,
+				ADD COLUMN IF NOT EXISTS idempotency_authorization_binding_id text,
+				ADD COLUMN IF NOT EXISTS invocation_provenance jsonb,
+				ADD COLUMN IF NOT EXISTS authorization_binding jsonb,
+				ADD COLUMN IF NOT EXISTS execution_reason text,
+				ADD COLUMN IF NOT EXISTS authorization_reconciliation jsonb,
 				ADD COLUMN IF NOT EXISTS authorization_binding_id text,
 				ADD COLUMN IF NOT EXISTS attempt_count integer NOT NULL DEFAULT 0,
 				ADD COLUMN IF NOT EXISTS lease_owner text,
@@ -1149,6 +1378,12 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				ON fabric_platform.action_invocations
 				(tenant_id, space_id, action_id, idempotency_key)
 				WHERE idempotency_key IS NOT NULL;
+			CREATE INDEX IF NOT EXISTS action_invocations_parameter_digest_idx
+				ON fabric_platform.action_invocations (tenant_id, parameter_digest)
+				WHERE parameter_digest IS NOT NULL;
+			CREATE INDEX IF NOT EXISTS action_invocations_authority_binding_idx
+				ON fabric_platform.action_invocations (tenant_id, authorization_binding_id)
+				WHERE authorization_binding_id IS NOT NULL;
 			CREATE INDEX IF NOT EXISTS action_invocations_worker_idx
 				ON fabric_platform.action_invocations (status, lease_expires_at, created_at);
 			CREATE TABLE IF NOT EXISTS fabric_platform.policy_evaluations (
@@ -1192,9 +1427,10 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				actor_id text NOT NULL, actor_type text NOT NULL, action_invocation_id text,
 				payload jsonb NOT NULL, sequence bigint NOT NULL,
 				occurred_at timestamptz NOT NULL, recorded_at timestamptz NOT NULL,
-				correlation_id text NOT NULL, causation_id text,
+				correlation_id text NOT NULL, causation_id text, provenance jsonb,
 				UNIQUE (tenant_id, space_id, sequence)
 			);
+			ALTER TABLE fabric_platform.asset_events ADD COLUMN IF NOT EXISTS provenance jsonb;
 			CREATE INDEX IF NOT EXISTS asset_events_subject_idx
 				ON fabric_platform.asset_events
 				(tenant_id, space_id, subject_type, subject_id, sequence);
@@ -1218,8 +1454,10 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
       `INSERT INTO fabric_platform.action_invocations
 			 (id,tenant_id,space_id,action_id,action_version,actor_id,actor_type,status,
 				  parameters,result,correlation_id,causation_id,idempotency_key,
+				  parameter_digest,parameter_digest_algorithm,idempotency_actor_id,
+				  idempotency_authorization_binding_id,invocation_provenance,authorization_binding,execution_reason,
 				  authorization_binding_id,error,runtime_evidence,created_at,updated_at)
-				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16::jsonb,$17,$17)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,$18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,$24,$24)
 			 ON CONFLICT (tenant_id,space_id,action_id,idempotency_key)
 			 WHERE idempotency_key IS NOT NULL DO UPDATE SET id=fabric_platform.action_invocations.id
 			 RETURNING *`,
@@ -1237,6 +1475,13 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         input.correlationId,
         input.causationId ?? null,
         input.idempotencyKey ?? null,
+        input.parameterDigest ?? null,
+        input.parameterDigestAlgorithm ?? null,
+        input.idempotencyActorId ?? null,
+        input.idempotencyAuthorizationBindingId ?? null,
+        input.provenance ? JSON.stringify(input.provenance) : null,
+        input.authorizationBinding ? JSON.stringify(input.authorizationBinding) : null,
+        input.executionReason ?? null,
         input.authorizationBindingId ?? null,
         input.error ?? null,
         input.runtimeEvidence ? JSON.stringify(input.runtimeEvidence) : null,
@@ -1258,9 +1503,10 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
       `UPDATE fabric_platform.action_invocations SET
 			 status=COALESCE($4,status), result=COALESCE($5::jsonb,result),
 			 error=CASE WHEN $6::boolean THEN $7 ELSE error END,
-			 lease_owner=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','validation_failed')
+			 authorization_reconciliation=CASE WHEN $8::boolean THEN $9::jsonb ELSE authorization_reconciliation END,
+			 lease_owner=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
-			 lease_expires_at=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','validation_failed')
+			 lease_expires_at=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                       THEN NULL ELSE lease_expires_at END,
 			 updated_at=now()
 			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3`,
@@ -1271,7 +1517,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         patch.status ?? null,
         patch.result === void 0 ? null : JSON.stringify(patch.result),
         Object.hasOwn(patch, "error"),
-        patch.error ?? null
+        patch.error ?? null,
+        Object.hasOwn(patch, "authorizationReconciliation"),
+        patch.authorizationReconciliation ? JSON.stringify(patch.authorizationReconciliation) : null
       ]
     );
   }
@@ -1466,8 +1714,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
       `INSERT INTO fabric_platform.asset_events
 			 (id,tenant_id,space_id,event_type,event_schema_version,subject_type,subject_id,
 			  actor_id,actor_type,action_invocation_id,payload,sequence,occurred_at,recorded_at,
-			  correlation_id,causation_id)
-				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16)
+			  correlation_id,causation_id,provenance)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16,$17::jsonb)
 				 ON CONFLICT (id) DO NOTHING`,
       [
         event.id,
@@ -1485,7 +1733,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         event.occurredAt,
         event.recordedAt,
         event.correlationId,
-        event.causationId ?? null
+        event.causationId ?? null,
+        event.provenance ? JSON.stringify(event.provenance) : null
       ]
     );
   }
@@ -1496,13 +1745,13 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				INSERT INTO fabric_platform.asset_events
 				 (id,tenant_id,space_id,event_type,event_schema_version,subject_type,subject_id,
 				  actor_id,actor_type,action_invocation_id,payload,sequence,occurred_at,recorded_at,
-				  correlation_id,causation_id)
-				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16)
+				  correlation_id,causation_id,provenance)
+				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11::jsonb,$12,$13,$14,$15,$16,$17::jsonb)
 				 ON CONFLICT (id) DO NOTHING RETURNING id
 			)
 			INSERT INTO fabric_platform.event_outbox
 			 (id,tenant_id,space_id,event,status,attempt_count,available_at,created_at)
-			SELECT $1,$2,$3,$17::jsonb,'pending',0,$14,$14 FROM inserted_event
+			SELECT $1,$2,$3,$18::jsonb,'pending',0,$14,$14 FROM inserted_event
 			ON CONFLICT (id) DO NOTHING`,
       [
         event.id,
@@ -1521,6 +1770,7 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         event.recordedAt,
         event.correlationId,
         event.causationId ?? null,
+        event.provenance ? JSON.stringify(event.provenance) : null,
         JSON.stringify(envelope)
       ]
     );
@@ -1681,6 +1931,14 @@ function toActionRecord(row) {
     correlationId: String(row.correlation_id),
     ...row.causation_id ? { causationId: String(row.causation_id) } : {},
     ...row.idempotency_key ? { idempotencyKey: String(row.idempotency_key) } : {},
+    ...row.parameter_digest ? { parameterDigest: String(row.parameter_digest) } : {},
+    ...row.parameter_digest_algorithm ? { parameterDigestAlgorithm: String(row.parameter_digest_algorithm) } : {},
+    ...row.idempotency_actor_id ? { idempotencyActorId: String(row.idempotency_actor_id) } : {},
+    ...row.idempotency_authorization_binding_id ? { idempotencyAuthorizationBindingId: String(row.idempotency_authorization_binding_id) } : {},
+    ...row.invocation_provenance ? { provenance: row.invocation_provenance } : {},
+    ...row.authorization_binding ? { authorizationBinding: row.authorization_binding } : {},
+    ...row.execution_reason ? { executionReason: String(row.execution_reason) } : {},
+    ...row.authorization_reconciliation ? { authorizationReconciliation: row.authorization_reconciliation } : {},
     ...row.authorization_binding_id ? { authorizationBindingId: String(row.authorization_binding_id) } : {},
     attemptCount: Number(row.attempt_count ?? 0),
     ...row.lease_owner ? { leaseOwner: String(row.lease_owner) } : {},
@@ -1754,7 +2012,8 @@ function toEventRecord(row) {
     occurredAt: new Date(row.occurred_at),
     recordedAt: new Date(row.recorded_at),
     correlationId: String(row.correlation_id),
-    ...row.causation_id ? { causationId: String(row.causation_id) } : {}
+    ...row.causation_id ? { causationId: String(row.causation_id) } : {},
+    ...row.provenance ? { provenance: row.provenance } : {}
   };
 }
 function toOutboxRecord(row) {
@@ -1775,6 +2034,7 @@ function toOutboxRecord(row) {
       ...event.actionInvocationId ? { actionInvocationId: String(event.actionInvocationId) } : {},
       correlationId: String(event.correlationId),
       ...event.causationId ? { causationId: String(event.causationId) } : {},
+      ...event.provenance ? { provenance: event.provenance } : {},
       occurredAt: new Date(event.occurredAt),
       recordedAt: new Date(event.recordedAt),
       producerModuleVersion: String(event.producerModuleVersion),
@@ -1861,12 +2121,16 @@ async function abortableDelay(milliseconds, signal) {
   });
 }
 
+exports.IdempotencyConflictError = IdempotencyConflictError;
 exports.MemoryPlatformHostStore = MemoryPlatformHostStore;
+exports.PARAMETER_DIGEST_ALGORITHM = PARAMETER_DIGEST_ALGORITHM;
 exports.PLATFORM_HOST_CONTRACT_VERSION = PLATFORM_HOST_CONTRACT_VERSION;
 exports.PostgresPlatformHostStore = PostgresPlatformHostStore;
+exports.canonicalJson = canonicalJson;
 exports.cloneOutboxRecord = cloneOutboxRecord;
 exports.createGovernedActionHost = createGovernedActionHost;
 exports.createStoreBackedActionDispatcher = createStoreBackedActionDispatcher;
+exports.digestParameters = digestParameters;
 exports.runOutboxRelayCycle = runOutboxRelayCycle;
 exports.runPlatformActionWorker = runPlatformActionWorker;
 exports.runPlatformActionWorkerCycle = runPlatformActionWorkerCycle;