@fabricorg/platform-host 4.0.0 → 6.0.0

package/dist/index.d.ts

@@ -1,4 +1,155 @@
 import { ActorType, ActionId, ActionStatus, AgentActionRoute, AgentActionRiskTier, MutationFootprint, ExecutionPrincipal, GovernanceRuntimeEvidence, PolicyOutcome, AssetEventEnvelope, ExecutionAttestation, ExternalReconciliation, PolicyObligation, PolicyObligationStatus, ModuleRegistry, ActionDefinition, AdapterImplementation, FabricRuntimeServices, AgentActionPolicyEvaluator, MutationGovernanceResolver, RuntimePolicyDefinition } from '@fabricorg/platform';
+import { AssemblyLockfile } from '@fabricorg/assembly';
+
+/** Version of the vendor-neutral health/readiness contract. */
+declare const PLATFORM_HOST_HEALTH_CONTRACT_VERSION: 1;
+/**
+ * Stable metric names. Adapters may translate these names to a vendor's
+ * naming convention, but applications should not derive names from labels.
+ */
+declare const PLATFORM_HOST_METRIC_NAMES: {
+    readonly workerCyclesStarted: "fabric.platform.worker.cycles.started";
+    readonly workerCyclesCompleted: "fabric.platform.worker.cycles.completed";
+    readonly workerCyclesFailed: "fabric.platform.worker.cycles.failed";
+    readonly invocationSubmitted: "fabric.platform.invocation.submitted";
+    readonly invocationExecutionStarted: "fabric.platform.invocation.execution_started";
+    readonly invocationLeaseClaimed: "fabric.platform.invocation.lease_claimed";
+    readonly invocationCompleted: "fabric.platform.invocation.completed";
+    readonly invocationFailed: "fabric.platform.invocation.failed";
+    readonly invocationPolicyBlocked: "fabric.platform.invocation.policy_blocked";
+    readonly invocationValidationFailed: "fabric.platform.invocation.validation_failed";
+    readonly invocationApprovalWaited: "fabric.platform.invocation.approval_waited";
+    readonly invocationReconciliationRequired: "fabric.platform.invocation.reconciliation_required";
+    readonly outboxRelayCyclesStarted: "fabric.platform.outbox.relay_cycles.started";
+    readonly outboxRelayCyclesCompleted: "fabric.platform.outbox.relay_cycles.completed";
+    readonly outboxRelayCyclesFailed: "fabric.platform.outbox.relay_cycles.failed";
+    readonly outboxLeaseClaimed: "fabric.platform.outbox.lease_claimed";
+    readonly outboxPublished: "fabric.platform.outbox.published";
+    readonly outboxFailed: "fabric.platform.outbox.failed";
+    readonly outboxDeadLettered: "fabric.platform.outbox.dead_lettered";
+    readonly invocationBacklog: "fabric.platform.invocation.backlog";
+    readonly invocationRunning: "fabric.platform.invocation.running";
+    readonly invocationExpiredLeases: "fabric.platform.invocation.expired_leases";
+    readonly invocationApprovalWaits: "fabric.platform.invocation.approval_waits";
+    readonly invocationReconciliationRequiredGauge: "fabric.platform.invocation.reconciliation_required.count";
+    readonly outboxBacklog: "fabric.platform.outbox.backlog";
+    readonly outboxExpiredLeases: "fabric.platform.outbox.expired_leases";
+    readonly outboxDeadLetters: "fabric.platform.outbox.dead_letters";
+};
+type PlatformHostMetricName = (typeof PLATFORM_HOST_METRIC_NAMES)[keyof typeof PLATFORM_HOST_METRIC_NAMES];
+type PlatformHostTelemetryEventName = "worker.cycle.started" | "worker.cycle.completed" | "worker.cycle.failed" | "invocation.submitted" | "invocation.execution_started" | "invocation.lease_claimed" | "invocation.completed" | "invocation.failed" | "invocation.policy_blocked" | "invocation.validation_failed" | "invocation.approval_waited" | "invocation.reconciliation_required" | "outbox.relay.started" | "outbox.relay.completed" | "outbox.relay.failed" | "outbox.lease_claimed" | "outbox.published" | "outbox.failed" | "outbox.dead_lettered";
+type PlatformHostMetricType = "counter" | "gauge";
+type PlatformHostTelemetryAttribute = string | number | boolean;
+interface PlatformHostLifecycleTelemetry {
+    kind: "event";
+    name: PlatformHostTelemetryEventName;
+    metricName: PlatformHostMetricName;
+    metricType: "counter";
+    occurredAt: Date;
+    tenantId?: string;
+    spaceId?: string;
+    attributes?: Readonly<Record<string, PlatformHostTelemetryAttribute>>;
+}
+interface PlatformHostMetricTelemetry {
+    kind: "metric";
+    name: PlatformHostMetricName;
+    metricType: PlatformHostMetricType;
+    value: number;
+    observedAt: Date;
+    tenantId?: string;
+    spaceId?: string;
+}
+type PlatformHostTelemetryRecord = PlatformHostLifecycleTelemetry | PlatformHostMetricTelemetry;
+type PlatformHostTelemetryHook = (record: PlatformHostTelemetryRecord) => void | Promise<void>;
+/**
+ * A deliberately small sink contract. No OpenTelemetry, Prometheus, or
+ * vendor SDK is required by Platform Host.
+ */
+type PlatformHostTelemetry = PlatformHostTelemetryHook | {
+    record: PlatformHostTelemetryHook;
+};
+type PlatformHostTelemetryInput = Omit<PlatformHostLifecycleTelemetry, "occurredAt" | "metricType"> & {
+    occurredAt?: Date;
+} | Omit<PlatformHostMetricTelemetry, "observedAt"> & {
+    observedAt?: Date;
+};
+/**
+ * Telemetry is best effort and must never change governed mutation behavior.
+ * Promise-returning hooks are detached and rejected hooks are swallowed.
+ */
+declare function emitPlatformHostTelemetry(telemetry: PlatformHostTelemetry | undefined, input: PlatformHostTelemetryInput): void;
+interface PlatformHostHealthQuery {
+    tenantId?: string;
+    spaceId?: string;
+    now: Date;
+}
+interface PlatformHostHealthCounts {
+    invocationBacklog: number;
+    invocationRunning: number;
+    invocationExpiredLeases: number;
+    invocationApprovalWaits: number;
+    invocationReconciliationRequired: number;
+    outboxBacklog: number;
+    outboxExpiredLeases: number;
+    outboxDeadLetters: number;
+}
+interface PlatformHostWorkerHealthInput {
+    lastHeartbeatAt: Date;
+    staleAfterMs: number;
+}
+interface PlatformHostHealthOptions<TDb> {
+    store: PlatformHostStore<TDb>;
+    tenantId?: string;
+    spaceId?: string;
+    now?: () => Date;
+    /**
+     * Worker liveness is supplied by the deployment's supervisor or telemetry
+     * bridge. Only aggregate healthy/stale counts are returned.
+     */
+    workers?: readonly PlatformHostWorkerHealthInput[];
+    telemetry?: PlatformHostTelemetry;
+}
+interface PlatformHostHealthStore<TDb> extends RecoverablePlatformHostStore<TDb> {
+    getHealthCounts(input: PlatformHostHealthQuery): Promise<PlatformHostHealthCounts>;
+}
+type PlatformHostHealthStatus = "healthy" | "degraded" | "unhealthy";
+interface PlatformHostHealthSnapshot {
+    contractVersion: typeof PLATFORM_HOST_HEALTH_CONTRACT_VERSION;
+    generatedAt: Date;
+    scope: {
+        tenantId?: string;
+        spaceId?: string;
+    };
+    dataAvailable: boolean;
+    status: PlatformHostHealthStatus;
+    readiness: {
+        ready: boolean;
+        reasonCodes: readonly PlatformHostReadinessReason[];
+    };
+    workers: {
+        reported: number;
+        healthy: number;
+        stale: number;
+    };
+    invocations: {
+        backlog: number;
+        running: number;
+        expiredLeases: number;
+        approvalWaits: number;
+        reconciliationRequired: number;
+    };
+    outbox: {
+        backlog: number;
+        expiredLeases: number;
+        deadLetters: number;
+    };
+}
+type PlatformHostReadinessReason = "health_source_unavailable" | "workers_stale" | "invocation_expired_leases" | "outbox_expired_leases" | "outbox_dead_letters" | "reconciliation_required";
+/**
+ * Read tenant/space-scoped operational counts without returning invocation,
+ * actor, parameter, error, event, or adapter data.
+ */
+declare function getPlatformHostHealthSnapshot<TDb>(options: PlatformHostHealthOptions<TDb>): Promise<PlatformHostHealthSnapshot>;
 
 /** Durable Host lifecycle generation, independent from the npm package version. */
 declare const PLATFORM_HOST_CONTRACT_VERSION: 2;
@@ -63,11 +214,15 @@ interface ActionInvocationRecord {
     authorizationBinding?: AuthorizationBinding;
     executionReason?: ActionExecutionReason;
     authorizationReconciliation?: AuthorizationReconciliationOutcome;
+    /** Durable evidence when an adapter returned an ambiguous outcome requiring reconciliation. */
+    adapterReconciliation?: AdapterReconciliationOutcome;
     /** Opaque, non-secret reference used to revalidate delegated execution authority. */
     authorizationBindingId?: string;
     attemptCount: number;
     leaseOwner?: string;
     leaseExpiresAt?: Date;
+    /** Monotonic claim generation used to reject writes from expired workers. */
+    leaseToken?: number;
     hitlRoute?: AgentActionRoute;
     hitlRiskTier?: AgentActionRiskTier;
     hitlReason?: string;
@@ -135,7 +290,18 @@ interface ExternalReconciliationRecord extends ExternalReconciliation {
     tenantId: string;
     spaceId: string;
 }
-type AdapterInvocationStatus = "running" | "succeeded" | "failed";
+type AdapterInvocationStatus = "running" | "succeeded" | "failed" | "ambiguous";
+interface AdapterReconciliationOutcome {
+    kind: "adapter_outcome_ambiguous";
+    adapterType: string;
+    operation: string;
+    vendor: string;
+    adapterInvocationId: string;
+    reason?: string;
+    /** Opaque, non-secret reference to external operation state for reconciliation. */
+    externalReference?: string;
+    message: string;
+}
 interface AdapterInvocationRecord {
     id: string;
     actionInvocationId: string;
@@ -152,14 +318,19 @@ interface AdapterInvocationRecord {
     createdAt: Date;
     updatedAt: Date;
 }
-interface CreateActionInvocationInput extends Omit<ActionInvocationRecord, "createdAt" | "updatedAt" | "attemptCount" | "leaseOwner" | "leaseExpiresAt"> {
+interface CreateActionInvocationInput extends Omit<ActionInvocationRecord, "createdAt" | "updatedAt" | "attemptCount" | "leaseOwner" | "leaseExpiresAt" | "leaseToken"> {
 }
 interface PlatformHostStore<TDb> {
     readonly db: TDb;
+    /**
+     * Run against the store's domain handle. This base seam does not promise a
+     * database transaction. Use `transactionWithEvents` when domain writes,
+     * canonical events, and invocation state must commit atomically.
+     */
     transaction<TResult>(run: (db: TDb) => Promise<TResult>): Promise<TResult>;
     createActionInvocation(input: CreateActionInvocationInput): Promise<ActionInvocationRecord>;
     getActionInvocation(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
-    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation">>): Promise<void>;
+    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation">>): Promise<void>;
     appendPolicyEvaluation(record: PolicyEvaluationRecord): Promise<void>;
     createAdapterInvocation(record: AdapterInvocationRecord): Promise<void>;
     getAdapterInvocation(id: string): Promise<AdapterInvocationRecord | undefined>;
@@ -178,11 +349,23 @@ interface PlatformHostStore<TDb> {
  */
 interface PlatformHostMutationTransaction<TDb> {
     readonly db: TDb;
+    /**
+     * Read and lock an invocation until this transaction completes.
+     * Required by serialized saga parent lifecycle transitions.
+     */
+    getActionInvocationForUpdate?(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
+    /**
+     * Read one event by its stable identity inside the transaction.
+     * Required by serialized saga parent lifecycle transitions.
+     */
+    getEvent?(id: string, tenantId: string, spaceId: string): Promise<AssetEventEnvelope | undefined>;
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     appendEventWithOutbox?(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
     listEvents(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
-    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation">>): Promise<void>;
+    getEntityState?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
+    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation">>): Promise<void>;
+    updateLeasedActionInvocation?(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
 }
 type OutboxStatus = "pending" | "published" | "dead_letter";
 type EventPayloadClassification = "public" | "internal" | "confidential" | "restricted";
@@ -213,6 +396,8 @@ interface EnterpriseEventEnvelope {
         source: InvocationSource;
         auditAttributes?: NamespacedAttributes;
     };
+    /** Present only for events an action declaring provisional consistency emitted. */
+    consistency?: "authoritative-now" | "provisional-until-reconciled";
     payload: unknown;
 }
 interface OutboxRecord {
@@ -225,6 +410,7 @@ interface OutboxRecord {
     availableAt: Date;
     leaseOwner?: string;
     leaseExpiresAt?: Date;
+    leaseToken?: number;
     lastError?: string;
     createdAt: Date;
     publishedAt?: Date;
@@ -242,14 +428,22 @@ interface OutboxPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
     readonly transactionalOutbox?: boolean;
     appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
-    markOutboxPublished(id: string, workerId: string, publishedAt: Date): Promise<void>;
+    markOutboxPublished(id: string, workerId: string, publishedAt: Date, leaseToken?: number): Promise<void>;
     markOutboxFailed(input: {
         id: string;
         workerId: string;
+        leaseToken?: number;
         error: string;
         availableAt: Date;
         deadLetter: boolean;
     }): Promise<void>;
+    renewOutboxLease(input: {
+        id: string;
+        workerId: string;
+        leaseToken: number;
+        leaseDurationMs: number;
+        now?: Date;
+    }): Promise<boolean>;
     listOutbox(input?: {
         tenantId?: string;
         spaceId?: string;
@@ -312,10 +506,30 @@ interface ClaimActionInvocationsInput {
     spaceId?: string;
     now?: Date;
 }
+type ActionInvocationPatch = Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation">>;
+interface UpdateLeasedActionInvocationInput {
+    id: string;
+    tenantId: string;
+    spaceId: string;
+    workerId: string;
+    leaseToken: number;
+    patch: ActionInvocationPatch;
+}
+interface RenewActionInvocationLeaseInput {
+    id: string;
+    tenantId: string;
+    spaceId: string;
+    workerId: string;
+    leaseToken: number;
+    leaseDurationMs: number;
+    now?: Date;
+}
 /** Store capabilities required by the durable polling worker and operator tooling. */
 interface RecoverablePlatformHostStore<TDb> extends PlatformHostStore<TDb> {
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
     claimActionInvocations(input: ClaimActionInvocationsInput): Promise<ActionInvocationRecord[]>;
+    updateLeasedActionInvocation(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
+    renewActionInvocationLease(input: RenewActionInvocationLeaseInput): Promise<boolean>;
     listEvents(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
 }
 interface ActionAuthorizationInput {
@@ -357,6 +571,7 @@ interface PlatformHostAuthorization {
 }
 interface DispatchActionInput {
     actionInvocationId: string;
+    actionId: ActionId;
     tenantId: string;
     spaceId: string;
     workflowId: string;
@@ -379,7 +594,7 @@ interface SubmitActionInput {
     causationId?: string;
     provenance?: InvocationProvenance;
     executionReason?: Extract<KnownActionExecutionReason, "initial" | "offline_replay">;
-    /** Stable logical command key. Reusing it returns the original invocation without re-dispatch. */
+    /** Stable logical command key. Reusing it returns the original invocation; a pending failed dispatch may retry its stable workflow ID. */
     idempotencyKey?: string;
     /** Opaque, non-secret authorization/admission reference persisted with the invocation. */
     authorizationBindingId?: string;
@@ -393,6 +608,9 @@ interface SubmitActionResult {
     result?: Record<string, unknown>;
     error?: string;
     reconciliation?: AuthorizationReconciliationOutcome;
+    adapterReconciliation?: AdapterReconciliationOutcome;
+    /** Mirrors the action's declared consistency so a caller knows whether the result is settled. */
+    consistency?: "authoritative-now" | "provisional-until-reconciled";
     hitlRoute?: AgentActionRoute;
     hitlRiskTier?: AgentActionRiskTier;
 }
@@ -402,12 +620,17 @@ interface ExecuteActionResult {
     result?: Record<string, unknown>;
     error?: string;
     reconciliation?: AuthorizationReconciliationOutcome;
+    adapterReconciliation?: AdapterReconciliationOutcome;
+    /** Mirrors the action's declared consistency so a caller knows whether the result is settled. */
+    consistency?: "authoritative-now" | "provisional-until-reconciled";
     hitlRoute?: AgentActionRoute;
     hitlRiskTier?: AgentActionRiskTier;
 }
 interface ExecuteInvocationOptions {
     /** Required when executing a row already protected by a worker or approval-resume lease. */
     leaseOwner?: string;
+    /** Claim generation paired with leaseOwner; stale generations are rejected. */
+    leaseToken?: number;
 }
 interface PlatformActionWorkerOptions<TDb> {
     host: GovernedActionHost;
@@ -415,11 +638,13 @@ interface PlatformActionWorkerOptions<TDb> {
     workerId: string;
     batchSize?: number;
     leaseDurationMs?: number;
+    leaseRenewalIntervalMs?: number;
     pollIntervalMs?: number;
     tenantId?: string;
     spaceId?: string;
     signal?: AbortSignal;
     onError?: (error: unknown, invocation?: ActionInvocationRecord) => void;
+    telemetry?: PlatformHostTelemetry;
 }
 interface PlatformActionWorkerCycleResult {
     claimed: number;
@@ -432,7 +657,7 @@ interface PlatformHostOptions<TDb> {
     store: PlatformHostStore<TDb>;
     authorization: PlatformHostAuthorization;
     /** Preferred explicit catalog assembled from this runtime's Fabric modules. */
-    registry?: Pick<ModuleRegistry<TDb>, "resolveAction" | "resolvePolicy" | "resolveStateMachine">;
+    registry?: Pick<ModuleRegistry<TDb>, "resolveAction" | "resolvePolicy" | "resolveStateMachine"> & Partial<Pick<ModuleRegistry<TDb>, "orderedModules">>;
     /** Resolve vertical- or runtime-local actions without mutating the process-wide registry. */
     resolveAction?: (actionId: ActionId) => ActionDefinition<TDb> | undefined;
     adapters?: readonly AdapterImplementation[];
@@ -482,6 +707,15 @@ interface PlatformHostOptions<TDb> {
     }) => Promise<ExecutionAttestation | undefined> | ExecutionAttestation | undefined;
     /** Package/provider/ruleset generations persisted with every newly created invocation. */
     runtimeEvidence?: Partial<GovernanceRuntimeEvidence>;
+    /**
+     * Trusted composition identity attached by the Host configuration, never
+     * accepted directly from submission input. Requires an explicit registry;
+     * its module namespaces and versions are checked against these identities.
+     */
+    composition?: {
+        assembly: AssemblyLockfile;
+        resolveInitiatingReleaseDigest?(input: SubmitActionInput): Promise<string | undefined> | string | undefined;
+    };
     /** Lease held while an approved invocation resumes; defaults to five minutes. */
     approvalResumeLeaseDurationMs?: number;
     /** Remove forbidden/sensitive fields before durable invocation persistence. */
@@ -498,6 +732,13 @@ interface PlatformHostOptions<TDb> {
         subjectId: string;
     } | undefined;
     now?: () => Date;
+    /** Vendor-neutral lifecycle and metric sink. Telemetry is best effort. */
+    telemetry?: PlatformHostTelemetry;
+    /**
+     * Epoch-millis deadline delivered to every adapter execution context.
+     * When omitted, no deadline is set and adapters receive no AbortSignal.
+     */
+    adapterDeadlineMs?: number;
 }
 interface GovernedActionHost {
     submitAction(input: SubmitActionInput): Promise<SubmitActionResult>;
@@ -531,7 +772,7 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     private runTransactionWithEvents;
     createActionInvocation(input: CreateActionInvocationInput): Promise<ActionInvocationRecord>;
     getActionInvocation(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
-    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation">>): Promise<void>;
+    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation">>): Promise<void>;
     recordHitlDecision(actionInvocationId: string, tenantId: string, spaceId: string, decision: HitlDecisionEvidence): Promise<ActionInvocationRecord>;
     beginApprovalDecision(input: BeginApprovalDecisionInput): Promise<ApprovalDecisionTransitionResult>;
     appendPolicyEvaluation(record: PolicyEvaluationRecord): Promise<void>;
@@ -551,14 +792,22 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
-    markOutboxPublished(id: string, workerId: string, publishedAt: Date): Promise<void>;
+    markOutboxPublished(id: string, workerId: string, publishedAt: Date, leaseToken?: number): Promise<void>;
     markOutboxFailed(input: {
         id: string;
         workerId: string;
+        leaseToken?: number;
         error: string;
         availableAt: Date;
         deadLetter: boolean;
     }): Promise<void>;
+    renewOutboxLease(input: {
+        id: string;
+        workerId: string;
+        leaseToken: number;
+        leaseDurationMs: number;
+        now?: Date;
+    }): Promise<boolean>;
     listOutbox(input?: {
         tenantId?: string;
         spaceId?: string;
@@ -568,23 +817,31 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
+    getHealthCounts(input: PlatformHostHealthQuery): Promise<PlatformHostHealthCounts>;
     claimActionInvocations(input: ClaimActionInvocationsInput): Promise<ActionInvocationRecord[]>;
+    updateLeasedActionInvocation(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
+    renewActionInvocationLease(input: RenewActionInvocationLeaseInput): Promise<boolean>;
     listEvents(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
 }
 
 declare function toEnterpriseEventEnvelope(event: AssetEventEnvelope, metadata: OutboxEventMetadata): EnterpriseEventEnvelope;
 interface EnterpriseEventPublisher {
-    publish(event: EnterpriseEventEnvelope): Promise<void>;
+    publish(event: EnterpriseEventEnvelope, context?: {
+        signal: AbortSignal;
+    }): Promise<void>;
 }
 interface OutboxRelayOptions<TDb> {
     store: OutboxPlatformHostStore<TDb>;
     publisher: EnterpriseEventPublisher;
     workerId: string;
     leaseDurationMs?: number;
+    leaseRenewalIntervalMs?: number;
+    publishTimeoutMs?: number;
     batchSize?: number;
     maxAttempts?: number;
     retryDelayMs?: (attempt: number) => number;
     now?: () => Date;
+    telemetry?: PlatformHostTelemetry;
 }
 interface OutboxRelayResult {
     claimed: number;
@@ -627,7 +884,7 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
     transaction<TResult>(run: (db: TDb) => Promise<TResult>): Promise<TResult>;
     createActionInvocation(input: CreateActionInvocationInput): Promise<ActionInvocationRecord>;
     getActionInvocation(id: string, tenantId: string, spaceId: string): Promise<ActionInvocationRecord | undefined>;
-    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation">>): Promise<void>;
+    updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: Partial<Pick<ActionInvocationRecord, "status" | "result" | "error" | "authorizationReconciliation" | "adapterReconciliation">>): Promise<void>;
     recordHitlDecision(actionInvocationId: string, tenantId: string, spaceId: string, decision: HitlDecisionEvidence): Promise<ActionInvocationRecord>;
     beginApprovalDecision(input: BeginApprovalDecisionInput): Promise<ApprovalDecisionTransitionResult>;
     appendPolicyEvaluation(record: PolicyEvaluationRecord): Promise<void>;
@@ -647,14 +904,22 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
-    markOutboxPublished(id: string, workerId: string, publishedAt: Date): Promise<void>;
+    markOutboxPublished(id: string, workerId: string, publishedAt: Date, leaseToken?: number): Promise<void>;
     markOutboxFailed(input: {
         id: string;
         workerId: string;
+        leaseToken?: number;
         error: string;
         availableAt: Date;
         deadLetter: boolean;
     }): Promise<void>;
+    renewOutboxLease(input: {
+        id: string;
+        workerId: string;
+        leaseToken: number;
+        leaseDurationMs: number;
+        now?: Date;
+    }): Promise<boolean>;
     listOutbox(input?: {
         tenantId?: string;
         spaceId?: string;
@@ -663,9 +928,26 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
+    getHealthCounts(input: PlatformHostHealthQuery): Promise<PlatformHostHealthCounts>;
     claimActionInvocations(input: ClaimActionInvocationsInput): Promise<ActionInvocationRecord[]>;
+    updateLeasedActionInvocation(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
+    renewActionInvocationLease(input: RenewActionInvocationLeaseInput): Promise<boolean>;
     listEvents(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
+    getEvent(id: string, tenantId: string, spaceId: string): Promise<AssetEventEnvelope | undefined>;
+}
+
+interface PostgresMigration {
+    version: number;
+    name: string;
+    sql: string;
 }
+/**
+ * Applies an immutable, ordered migration set in one PostgreSQL transaction.
+ *
+ * The transaction-scoped advisory lock serializes migrators. A previously
+ * applied version may be presented again only when its checksum is unchanged.
+ */
+declare function applyPostgresMigrations(client: PlatformHostSqlClient, migrations: readonly PostgresMigration[]): Promise<void>;
 
 declare const PARAMETER_DIGEST_ALGORITHM: "fabric-canonical-json-sha256-v1";
 declare function canonicalJson(value: unknown): string;
@@ -681,4 +963,92 @@ declare function runPlatformActionWorkerCycle<TDb>(options: PlatformActionWorker
 /** Poll until aborted. Each iteration is bounded and waits without busy-spinning. */
 declare function runPlatformActionWorker<TDb>(options: PlatformActionWorkerOptions<TDb>): Promise<void>;
 
-export { type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventEnvelope, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, type PendingAssetEvent, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PolicyEvaluationRecord, type PolicyObligationRecord, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type RecoverablePlatformHostStore, type SubmitActionInput, type SubmitActionResult, canonicalJson, cloneOutboxRecord, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, toEnterpriseEventEnvelope };
+interface HostSagaParentLifecycleIdentity {
+    /** Stable identity shared by every retry of the same lifecycle transition. */
+    lifecycleId?: string;
+}
+/**
+ * Durable record of a single step completing within a saga parent.
+ * Structurally compatible with {@link import("@fabricorg/platform-temporal").SagaParentProgressRecord}.
+ */
+interface HostSagaParentProgressRecord {
+    stepId: string;
+    index: number;
+    total: number;
+    completedAt: string;
+}
+interface HostSagaParentProgressInput extends HostSagaParentLifecycleIdentity {
+    parentInvocationId: string;
+    tenantId: string;
+    spaceId: string;
+    progress: HostSagaParentProgressRecord;
+}
+interface HostSagaParentApprovalInput extends HostSagaParentLifecycleIdentity {
+    parentInvocationId: string;
+    tenantId: string;
+    spaceId: string;
+    stepId: string;
+    approvalId: string;
+    reason: string;
+}
+interface HostSagaParentCancellationInput extends HostSagaParentLifecycleIdentity {
+    parentInvocationId: string;
+    tenantId: string;
+    spaceId: string;
+    reason: string;
+    actorId: string;
+}
+interface HostSagaParentCompletionInput extends HostSagaParentLifecycleIdentity {
+    parentInvocationId: string;
+    tenantId: string;
+    spaceId: string;
+    result: Record<string, unknown>;
+}
+interface HostSagaParentFailureInput extends HostSagaParentLifecycleIdentity {
+    parentInvocationId: string;
+    tenantId: string;
+    spaceId: string;
+    error: string;
+    compensation: HostCompensationRecord[];
+}
+interface HostCompensationRecord {
+    stepId: string;
+    actionId: string;
+    error?: string;
+}
+/**
+ * Durable saga parent lifecycle contract backed by a Platform Host store.
+ *
+ * Structurally compatible with {@link import("@fabricorg/platform-temporal").SagaParentLifecycle}
+ * so an instance can be passed directly to
+ * {@link import("@fabricorg/platform-temporal").createSagaParentActivities}.
+ *
+ * Every transition is durable: the parent invocation row is the authoritative
+ * state, and lifecycle events are the audit trail. A worker that rolls over
+ * mid-saga can create a fresh adapter pointing at the same store and observe
+ * the persisted progress, approval park, cancellation, completion, or failure
+ * without in-memory state.
+ */
+interface HostSagaParentLifecycle {
+    recordProgress(input: HostSagaParentProgressInput): Promise<void>;
+    parkApproval(input: HostSagaParentApprovalInput): Promise<void>;
+    cancel(input: HostSagaParentCancellationInput): Promise<void>;
+    complete(input: HostSagaParentCompletionInput): Promise<void>;
+    fail(input: HostSagaParentFailureInput): Promise<void>;
+}
+interface CreateDurableSagaParentLifecycleOptions<TDb> {
+    store: PlatformHostStore<TDb>;
+    /** Optional clock for deterministic tests. */
+    now?: () => Date;
+}
+/**
+ * Create a {@link HostSagaParentLifecycle} backed by a Platform Host store.
+ *
+ * The parent invocation must already exist in the store (created by
+ * `submitAction` or `createActionInvocation`). Each method appends a typed
+ * lifecycle event and transitions the parent invocation to the appropriate
+ * status so a fresh worker can observe the persisted state after a rollover.
+ */
+declare function createDurableSagaParentLifecycle<TDb>(options: CreateDurableSagaParentLifecycleOptions<TDb>): HostSagaParentLifecycle;
+
+export { type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventEnvelope, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type SubmitActionInput, type SubmitActionResult, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, canonicalJson, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, toEnterpriseEventEnvelope };