@fabricorg/platform-host 7.0.0 → 7.1.0

package/dist/index.cjs

@@ -17,6 +17,18 @@ var IdempotencyConflictError = class extends Error {
   conflict;
   code = "IDEMPOTENCY_CONFLICT";
 };
+var ExternalCompletionError = class extends Error {
+  constructor(refusal, message) {
+    super(message);
+    this.refusal = refusal;
+    this.name = "ExternalCompletionError";
+  }
+  refusal;
+  code = "EXTERNAL_COMPLETION_REFUSED";
+  get retryable() {
+    return this.refusal === "still_executing";
+  }
+};
 var PARAMETER_DIGEST_ALGORITHM = "fabric-canonical-json-sha256-v1";
 function canonicalJson(value) {
   return JSON.stringify(sort(value));
@@ -431,7 +443,8 @@ function createGovernedActionHost(options) {
         ...durableInvocation.hitlRoute ? { hitlRoute: durableInvocation.hitlRoute } : {},
         ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {},
         ...durableInvocation.authorizationReconciliation ? { reconciliation: durableInvocation.authorizationReconciliation } : {},
-        ...durableInvocation.adapterReconciliation ? { adapterReconciliation: durableInvocation.adapterReconciliation } : {}
+        ...durableInvocation.adapterReconciliation ? { adapterReconciliation: durableInvocation.adapterReconciliation } : {},
+        ...durableInvocation.pendingCompletion ? { pendingCompletion: durableInvocation.pendingCompletion } : {}
       }, input.actionId);
     }
     if (options.dispatcher) {
@@ -476,6 +489,9 @@ function createGovernedActionHost(options) {
     if (isTerminal(invocation.status) || invocation.status === "waiting_for_approval") {
       return withConsistency(actionResult(invocation), invocation.actionId);
     }
+    if (invocation.status === "running" && invocation.pendingCompletion && !invocation.leaseOwner) {
+      return withConsistency(actionResult(invocation), invocation.actionId);
+    }
     if (invocation.status === "running" && invocation.leaseOwner && (executionOptions.leaseOwner !== invocation.leaseOwner || (invocation.leaseToken ?? 0) > 0 && executionOptions.leaseToken !== invocation.leaseToken)) {
       return {
         ...actionResult(invocation),
@@ -810,6 +826,7 @@ function createGovernedActionHost(options) {
       } catch (error) {
         return fail(invocation, "failed", errorMessage(error));
       }
+      let pendingHandoff = invocation.pendingCompletion;
       for (const [stepIndex, step] of (action.adapterSteps ?? []).entries()) {
         const input = step.getInput(parsed.data, data);
         if (!input) continue;
@@ -819,6 +836,28 @@ function createGovernedActionHost(options) {
           adapterInvocationId
         );
         if (previousAdapterInvocation?.status === "succeeded") continue;
+        if (pendingHandoff?.adapterInvocationId === adapterInvocationId) {
+          const subject = options.adapterEventSubject?.(action.actionId, parsed.data, data) ?? { subjectType: "AdapterInvocation", subjectId: adapterInvocationId };
+          await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", updatedAt: now() });
+          await appendEvent(invocation, {
+            eventType: "ExternalOperationAccepted",
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            payload: {
+              adapterType: step.adapterType,
+              operation: step.operation,
+              externalReference: pendingHandoff.externalReference,
+              ...pendingHandoff.dueAt ? { dueAt: pendingHandoff.dueAt.toISOString() } : {}
+            }
+          }, `adapter:${stepIndex}:accepted`);
+          await appendEvent(invocation, {
+            eventType: "AdapterInvocationSucceeded",
+            subjectType: subject.subjectType,
+            subjectId: subject.subjectId,
+            payload: { adapterType: step.adapterType, operation: step.operation, recovered: true }
+          }, `adapter:${stepIndex}:succeeded`);
+          continue;
+        }
         const adapterEventSubject = options.adapterEventSubject?.(
           action.actionId,
           parsed.data,
@@ -973,6 +1012,63 @@ function createGovernedActionHost(options) {
               ([key]) => key !== "success" && key !== "error"
             )
           );
+          const handoff = result2.acceptedExternalOperation;
+          if (handoff) {
+            const reference = typeof handoff.externalReference === "string" ? handoff.externalReference.trim() : "";
+            if (reference === "") {
+              const message = `Adapter ${step.adapterType}:${step.operation} accepted an external operation without a reference to complete it by; the external effect may be in flight.`;
+              await persistInvocation(invocation, { status: "reconciliation_required", error: message });
+              return withConsistency({ actionInvocationId, status: "reconciliation_required", error: message }, action.actionId);
+            }
+            const acceptedAt = now();
+            const deadlineMs2 = action.execution?.completionDeadlineMs;
+            const accepted = {
+              provider: adapter.vendor,
+              adapterType: step.adapterType,
+              operation: step.operation,
+              adapterInvocationId,
+              externalReference: reference,
+              acceptedAt,
+              ...deadlineMs2 ? { dueAt: new Date(acceptedAt.getTime() + deadlineMs2) } : {}
+            };
+            const completion = action.execution?.completion ?? "immediate";
+            const refuse = completion === "immediate" ? `Adapter ${step.adapterType}:${step.operation} handed off external operation "${reference}" but ${action.actionId} declares immediate completion; the external effect may be in flight.` : pendingHandoff ? `Adapter ${step.adapterType}:${step.operation} handed off a second external operation "${reference}" while "${pendingHandoff.externalReference}" is already pending; one invocation waits on one completion.` : void 0;
+            if (refuse) {
+              await options.store.updateAdapterInvocation(adapterInvocationId, { status: "succeeded", output, updatedAt: now() });
+              await persistInvocation(invocation, {
+                status: "reconciliation_required",
+                error: refuse,
+                ...pendingHandoff ? {} : { pendingCompletion: accepted }
+              });
+              let error = refuse;
+              try {
+                await recordCompletionReconciliation(invocation, { externalReference: reference, provider: adapter.vendor }, refuse);
+              } catch (logError) {
+                error = `${refuse} Reconciliation log unavailable: ${errorMessage(logError)}`;
+                await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { error });
+              }
+              return withConsistency({
+                actionInvocationId,
+                status: "reconciliation_required",
+                error,
+                ...pendingHandoff ? { pendingCompletion: pendingHandoff } : { pendingCompletion: accepted }
+              }, action.actionId);
+            }
+            pendingHandoff = accepted;
+            await persistInvocation(invocation, { pendingCompletion: accepted });
+            invocation = { ...invocation, pendingCompletion: accepted };
+            await appendEvent(invocation, {
+              eventType: "ExternalOperationAccepted",
+              subjectType: adapterEventSubject.subjectType,
+              subjectId: adapterEventSubject.subjectId,
+              payload: {
+                adapterType: step.adapterType,
+                operation: step.operation,
+                externalReference: reference,
+                ...accepted.dueAt ? { dueAt: accepted.dueAt.toISOString() } : {}
+              }
+            }, `adapter:${stepIndex}:accepted`);
+          }
           await options.store.updateAdapterInvocation(adapterInvocationId, {
             status: "succeeded",
             output,
@@ -1022,10 +1118,24 @@ function createGovernedActionHost(options) {
         const obligations = await governanceStore.listPolicyObligations(actionInvocationId, tenantId, spaceId);
         const unsatisfied = obligations.filter((obligation) => (obligation.required ?? true) && obligation.status !== "satisfied" && obligation.status !== "waived");
         if (unsatisfied.length > 0) {
-          return fail(invocation, "failed", `Unsatisfied policy obligations: ${unsatisfied.map((item) => item.id).join(", ")}`);
+          const message = `Unsatisfied policy obligations: ${unsatisfied.map((item) => item.id).join(", ")}`;
+          if (pendingHandoff) {
+            await persistInvocation(invocation, { status: "reconciliation_required", error: message });
+            let error = message;
+            try {
+              await recordCompletionReconciliation(invocation, { externalReference: pendingHandoff.externalReference, provider: pendingHandoff.provider, kind: "obligations" }, message);
+            } catch (logError) {
+              error = `${message} Reconciliation log unavailable: ${errorMessage(logError)}`;
+              await options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, { error });
+            }
+            return withConsistency({ actionInvocationId, status: "reconciliation_required", error, pendingCompletion: pendingHandoff }, action.actionId);
+          }
+          return fail(invocation, "failed", message);
         }
       }
       const result = withoutPrivateHostFields(data, eventResultFields);
+      const parked = pendingHandoff ? { ...pendingHandoff, parkedAt: now() } : void 0;
+      const finalPatch = parked ? { status: "running", result, pendingCompletion: parked } : { status: "completed", result };
       try {
         const atomicStore = asAtomicMutationStore(options.store);
         if (action.eventPhase === "after_adapters" && atomicStore) {
@@ -1049,7 +1159,7 @@ function createGovernedActionHost(options) {
                 spaceId,
                 workerId: invocation.leaseOwner,
                 leaseToken: invocation.leaseToken,
-                patch: { status: "completed", result }
+                patch: finalPatch
               });
               if (!updated) throw new RecoverableFinalizationError(`Invocation lease lost: ${actionInvocationId}`);
             } else {
@@ -1057,26 +1167,25 @@ function createGovernedActionHost(options) {
                 actionInvocationId,
                 tenantId,
                 spaceId,
-                { status: "completed", result }
+                finalPatch
               );
             }
           });
-          emitInvocationStatusTelemetry(
-            invocation,
-            "completed",
-            options.telemetry,
-            now()
-          );
+          if (!pendingHandoff) {
+            emitInvocationStatusTelemetry(
+              invocation,
+              "completed",
+              options.telemetry,
+              now()
+            );
+          }
         } else {
           if (action.eventPhase === "after_adapters") {
             for (const [index, event] of domainEvents.entries()) {
               await appendEvent(invocation, event, `domain:${index}`, action.version);
             }
           }
-          await persistInvocation(invocation, {
-            status: "completed",
-            result
-          });
+          await persistInvocation(invocation, finalPatch);
         }
       } catch (error) {
         if (action.eventPhase === "after_adapters") {
@@ -1086,8 +1195,9 @@ function createGovernedActionHost(options) {
       }
       return {
         actionInvocationId,
-        status: "completed",
+        status: parked ? "running" : "completed",
         result,
+        ...parked ? { pendingCompletion: parked } : {},
         ...invocation.hitlRoute ? { hitlRoute: invocation.hitlRoute } : {},
         ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {}
       };
@@ -1206,6 +1316,163 @@ function createGovernedActionHost(options) {
       spaceId
     });
   }
+  async function completeExternalInvocation(actionInvocationId, tenantId, spaceId, completion) {
+    if (typeof completion.externalReference !== "string" || completion.externalReference.trim() === "") {
+      throw new ExternalCompletionError("invalid_completion", "External completion must name the external reference it completes.");
+    }
+    if (completion.outcome !== "completed" && completion.outcome !== "failed") {
+      throw new ExternalCompletionError("invalid_completion", `External completion outcome must be "completed" or "failed", received "${String(completion.outcome)}".`);
+    }
+    const atomicStore = asAtomicMutationStore(options.store);
+    if (atomicStore) {
+      return atomicStore.transactionWithEvents(async (transaction) => {
+        const read2 = transaction.getActionInvocationForUpdate ? await transaction.getActionInvocationForUpdate(actionInvocationId, tenantId, spaceId) : await options.store.getActionInvocation(actionInvocationId, tenantId, spaceId);
+        return settleExternalCompletion(read2, actionInvocationId, completion, {
+          update: (patch) => transaction.updateActionInvocation(actionInvocationId, tenantId, spaceId, patch),
+          transaction
+        });
+      });
+    }
+    const read = await options.store.getActionInvocation(actionInvocationId, tenantId, spaceId);
+    return settleExternalCompletion(read, actionInvocationId, completion, {
+      update: (patch) => options.store.updateActionInvocation(actionInvocationId, tenantId, spaceId, patch)
+    });
+  }
+  async function settleExternalCompletion(invocation, actionInvocationId, completion, writer) {
+    if (!invocation) throw new ExternalCompletionError("not_found", `ActionInvocation not found: ${actionInvocationId}`);
+    const recorded = invocation.externalCompletion;
+    const stillExecuting = !recorded && (invocation.status === "pending" || invocation.status === "running" && (invocation.leaseOwner !== void 0 || invocation.pendingCompletion?.parkedAt === void 0));
+    if (stillExecuting) {
+      throw new ExternalCompletionError("still_executing", `ActionInvocation ${actionInvocationId} is still executing; retry the completion after it parks.`);
+    }
+    if (recorded) {
+      if (recorded.externalReference !== completion.externalReference) {
+        throw new ExternalCompletionError("reference_mismatch", `ActionInvocation ${actionInvocationId} was completed by "${recorded.externalReference}", not "${completion.externalReference}".`);
+      }
+      if (completion.provider !== void 0 && recorded.provider !== void 0 && completion.provider !== recorded.provider) {
+        throw new ExternalCompletionError("provider_mismatch", `ActionInvocation ${actionInvocationId} was completed by "${recorded.provider}", not "${completion.provider}".`);
+      }
+      if (recorded.outcome === completion.outcome) {
+        return withConsistency(actionResult(invocation), invocation.actionId);
+      }
+      const message = `External operation "${completion.externalReference}" reported ${completion.outcome} after reporting ${recorded.outcome}.`;
+      await recordCompletionReconciliation(invocation, { ...completion, kind: `contradicted:${completion.outcome}` }, message);
+      await appendEvent(invocation, {
+        eventType: "ExternalOperationContradicted",
+        subjectType: "AdapterInvocation",
+        subjectId: invocation.pendingCompletion?.adapterInvocationId ?? actionInvocationId,
+        payload: { externalReference: completion.externalReference, recorded: recorded.outcome, reported: completion.outcome }
+      }, `external:${completion.externalReference}:contradicted:${completion.outcome}`, 1, writer.transaction);
+      await writer.update({ status: "reconciliation_required", error: message });
+      emitInvocationStatusTelemetry(invocation, "reconciliation_required", options.telemetry, now(), invocation.status);
+      return withConsistency(actionResult({ ...invocation, status: "reconciliation_required", error: message }), invocation.actionId);
+    }
+    const pending = invocation.pendingCompletion;
+    if (!pending) {
+      const action = actionResolver(invocation.actionId);
+      if ((action?.execution?.completion ?? "immediate") === "immediate") {
+        throw new ExternalCompletionError("immediate_contract", `Action ${invocation.actionId} declares immediate completion; nothing external completes it.`);
+      }
+      throw new ExternalCompletionError("not_awaiting", `ActionInvocation ${actionInvocationId} is not awaiting an external completion.`);
+    }
+    if (pending.externalReference !== completion.externalReference) {
+      throw new ExternalCompletionError("reference_mismatch", `ActionInvocation ${actionInvocationId} awaits "${pending.externalReference}", not "${completion.externalReference}".`);
+    }
+    if (completion.provider !== void 0 && completion.provider !== pending.provider) {
+      throw new ExternalCompletionError("provider_mismatch", `ActionInvocation ${actionInvocationId} awaits completion from "${pending.provider}", not "${completion.provider}".`);
+    }
+    const recordedAt = now();
+    const externalCompletion = {
+      ...completion,
+      provider: completion.provider ?? pending.provider,
+      observedAt: completion.observedAt instanceof Date ? completion.observedAt.toISOString() : completion.observedAt,
+      recordedAt
+    };
+    const subject = { subjectType: "AdapterInvocation", subjectId: pending.adapterInvocationId };
+    const settles = invocation.status === "running" && pending.parkedAt !== void 0 || invocation.status === "reconciliation_required" && invocation.error?.includes("did not complete by") === true;
+    if (completion.outcome === "completed") {
+      const action = actionResolver(invocation.actionId);
+      const merged = withoutPrivateHostFields({ ...invocation.result, ...completion.result ?? {} }, eventResultFields);
+      if (action?.resultSchema) {
+        const parsedResult = action.resultSchema.safeParse(merged);
+        if (!parsedResult.success) {
+          throw new ExternalCompletionError("result_invalid", `External completion result validation failed at ${parsedResult.error.issues.map((issue) => issue.path.map(String).join(".") || "result").join(", ")}`);
+        }
+      }
+      await options.store.updateAdapterInvocation(pending.adapterInvocationId, {
+        ...completion.result ? { output: withoutPrivateHostFields(completion.result, eventResultFields) } : {},
+        updatedAt: recordedAt
+      });
+      await appendEvent(invocation, {
+        eventType: "ExternalOperationCompleted",
+        ...subject,
+        payload: { externalReference: pending.externalReference, provider: pending.provider, ...completion.result ? { result: withoutPrivateHostFields(completion.result, eventResultFields) } : {} }
+      }, `external:${pending.adapterInvocationId}:completed`, 1, writer.transaction);
+      const patch2 = settles ? { status: "completed", result: merged, externalCompletion, pendingCompletion: void 0, error: void 0 } : { externalCompletion, pendingCompletion: void 0 };
+      await writer.update(patch2);
+      if (settles) emitInvocationStatusTelemetry(invocation, "completed", options.telemetry, now(), invocation.status);
+      return withConsistency(actionResult({ ...invocation, ...patch2, result: settles ? merged : invocation.result, ...settles ? { error: void 0 } : {} }), invocation.actionId);
+    }
+    const error = completion.error ?? `External operation "${pending.externalReference}" failed.`;
+    await options.store.updateAdapterInvocation(pending.adapterInvocationId, { status: "failed", error, updatedAt: recordedAt });
+    await appendEvent(invocation, {
+      eventType: "ExternalOperationFailed",
+      ...subject,
+      payload: { externalReference: pending.externalReference, provider: pending.provider, error }
+    }, `external:${pending.adapterInvocationId}:failed`, 1, writer.transaction);
+    const patch = settles ? { status: "failed", error, externalCompletion, pendingCompletion: void 0 } : { externalCompletion, pendingCompletion: void 0 };
+    await writer.update(patch);
+    if (settles) emitInvocationStatusTelemetry(invocation, "failed", options.telemetry, now(), invocation.status);
+    return withConsistency(actionResult({ ...invocation, ...patch }), invocation.actionId);
+  }
+  async function recordCompletionReconciliation(invocation, completion, reason) {
+    const governanceStore = asGovernanceStore(options.store);
+    if (!governanceStore) throw new Error("External completion reconciliation requires a governance-capable store.");
+    const provider = completion.provider ?? invocation.pendingCompletion?.provider ?? invocation.externalCompletion?.provider ?? "external";
+    const seed = crypto.createHash("sha256").update(`${provider}\0${completion.externalReference}\0${completion.kind ?? "refused"}`).digest("hex").slice(0, 32);
+    await governanceStore.appendExternalReconciliation({
+      id: lifecycleId("rec", invocation.id, `ext:${seed}`),
+      actionInvocationId: invocation.id,
+      tenantId: invocation.tenantId,
+      spaceId: invocation.spaceId,
+      status: "pending",
+      provider,
+      externalOperationId: completion.externalReference,
+      attempt: 1,
+      reason,
+      ...completion.evidenceReferences ? { evidenceReferences: completion.evidenceReferences } : {},
+      observedAt: now()
+    });
+  }
+  async function reconcileOverdueCompletions(input = {}) {
+    const recoverable = options.store;
+    if (!recoverable.listActionInvocations) {
+      throw new Error("Overdue completion reconciliation requires a store that can list invocations.");
+    }
+    if (!asGovernanceStore(options.store)) {
+      throw new Error("Overdue completion reconciliation requires a governance-capable store to record its findings.");
+    }
+    const current = input.now ?? now();
+    const candidates = await recoverable.listActionInvocations({
+      statuses: ["running"],
+      completionDueBefore: current,
+      unleased: true,
+      ...input.tenantId ? { tenantId: input.tenantId } : {},
+      ...input.spaceId ? { spaceId: input.spaceId } : {},
+      limit: Math.max(1, Math.min(input.limit ?? 100, 1e3))
+    });
+    const overdue = [];
+    for (const invocation of candidates) {
+      const pending = invocation.pendingCompletion;
+      if (!pending?.dueAt || pending.dueAt.getTime() > current.getTime()) continue;
+      if (invocation.leaseOwner) continue;
+      const message = `External operation "${pending.externalReference}" from ${pending.provider} did not complete by ${pending.dueAt.toISOString()}.`;
+      await recordCompletionReconciliation(invocation, { externalReference: pending.externalReference, provider: pending.provider, kind: "overdue" }, message);
+      await persistInvocation(invocation, { status: "reconciliation_required", error: message });
+      overdue.push(invocation.id);
+    }
+    return { overdue };
+  }
   function declaredConsistency(actionId) {
     return actionResolver(actionId)?.execution?.consistency;
   }
@@ -1239,7 +1506,7 @@ function createGovernedActionHost(options) {
       ...declaredConsistency(invocation.actionId) === "provisional-until-reconciled" ? { consistency: "provisional-until-reconciled" } : {}
     };
     if (options.outbox) {
-      const hostLifecycleEvent = (/* @__PURE__ */ new Set(["AdapterInvocationStarted", "AdapterInvocationSucceeded", "AdapterInvocationFailed", "ComplianceBlocked"])).has(envelope.eventType);
+      const hostLifecycleEvent = (/* @__PURE__ */ new Set(["AdapterInvocationStarted", "AdapterInvocationSucceeded", "AdapterInvocationFailed", "ExternalOperationAccepted", "ExternalOperationCompleted", "ExternalOperationFailed", "ExternalOperationContradicted", "ComplianceBlocked"])).has(envelope.eventType);
       const shouldPublish = options.outbox.shouldPublish?.(envelope) ?? !hostLifecycleEvent;
       if (!shouldPublish) {
         await (transaction ?? options.store).appendEvent(envelope);
@@ -1302,7 +1569,7 @@ function createGovernedActionHost(options) {
     );
     emitInvocationStatusTelemetry(invocation, patch.status, options.telemetry, now(), previousStatus);
   }
-  return { submitAction, executeInvocation, resumeApprovedInvocation, recordExecutionAttestation, recordExternalReconciliation };
+  return { submitAction, executeInvocation, resumeApprovedInvocation, recordExecutionAttestation, recordExternalReconciliation, completeExternalInvocation, reconcileOverdueCompletions };
 }
 function actionResult(invocation) {
   return {
@@ -1313,7 +1580,8 @@ function actionResult(invocation) {
     ...invocation.hitlRoute ? { hitlRoute: invocation.hitlRoute } : {},
     ...invocation.hitlRiskTier ? { hitlRiskTier: invocation.hitlRiskTier } : {},
     ...invocation.authorizationReconciliation ? { reconciliation: invocation.authorizationReconciliation } : {},
-    ...invocation.adapterReconciliation ? { adapterReconciliation: invocation.adapterReconciliation } : {}
+    ...invocation.adapterReconciliation ? { adapterReconciliation: invocation.adapterReconciliation } : {},
+    ...invocation.pendingCompletion ? { pendingCompletion: invocation.pendingCompletion } : {}
   };
 }
 function asApprovalStore(store) {
@@ -1713,6 +1981,13 @@ var MemoryPlatformHostStore = class {
     const record = await this.getActionInvocation(id, tenantId, spaceId);
     if (!record) throw new Error(`ActionInvocation not found: ${id}`);
     Object.assign(record, patch, { updatedAt: /* @__PURE__ */ new Date() });
+    if (Object.hasOwn(patch, "pendingCompletion") && patch.pendingCompletion === void 0) delete record.pendingCompletion;
+    if (Object.hasOwn(patch, "externalCompletion") && patch.externalCompletion === void 0) delete record.externalCompletion;
+    if (Object.hasOwn(patch, "error") && patch.error === void 0) delete record.error;
+    if (patch.pendingCompletion && patch.status === "running") {
+      delete record.leaseOwner;
+      delete record.leaseExpiresAt;
+    }
     if (patch.status === "waiting_for_approval" || patch.status === "completed" || patch.status === "failed" || patch.status === "blocked_by_policy" || patch.status === "reconciliation_required" || patch.status === "validation_failed") {
       delete record.leaseOwner;
       delete record.leaseExpiresAt;
@@ -1881,7 +2156,7 @@ var MemoryPlatformHostStore = class {
   }
   async listActionInvocations(input = {}) {
     return this.invocations.filter(
-      (record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId) && (!input.statuses?.length || input.statuses.includes(record.status)) && (!input.updatedBefore || record.updatedAt < input.updatedBefore)
+      (record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId) && (!input.statuses?.length || input.statuses.includes(record.status)) && (!input.updatedBefore || record.updatedAt < input.updatedBefore) && (!(input.awaitingCompletion || input.completionDueBefore) || record.pendingCompletion !== void 0) && (!input.completionDueBefore || record.pendingCompletion?.dueAt !== void 0 && record.pendingCompletion.dueAt <= input.completionDueBefore) && (!input.unleased || record.leaseOwner === void 0)
     ).sort((left, right) => left.createdAt.getTime() - right.createdAt.getTime()).slice(0, input.limit ?? 100);
   }
   async getHealthCounts(input) {
@@ -2168,6 +2443,18 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				ALTER TABLE fabric_platform.event_outbox
 					ADD COLUMN lease_token bigint NOT NULL DEFAULT 0;
 			`
+    }, {
+      version: 3,
+      name: "external_completion",
+      sql: `
+				ALTER TABLE fabric_platform.action_invocations
+					ADD COLUMN pending_completion jsonb,
+					ADD COLUMN external_completion jsonb,
+					ADD COLUMN completion_due_at timestamptz;
+				CREATE INDEX action_invocations_completion_due_idx
+					ON fabric_platform.action_invocations (completion_due_at)
+					WHERE completion_due_at IS NOT NULL;
+			`
     }]);
   }
   async transaction(run) {
@@ -2230,9 +2517,12 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 error=CASE WHEN $6::boolean THEN $7 ELSE error END,
 			 authorization_reconciliation=CASE WHEN $8::boolean THEN $9::jsonb ELSE authorization_reconciliation END,
 			 adapter_reconciliation=CASE WHEN $10::boolean THEN $11::jsonb ELSE adapter_reconciliation END,
-			 lease_owner=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
+			 pending_completion=CASE WHEN $12::boolean THEN $13::jsonb ELSE pending_completion END,
+			 completion_due_at=CASE WHEN $12::boolean THEN ($13::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
+			 external_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE external_completion END,
+			 lease_owner=CASE WHEN ($13::jsonb IS NOT NULL AND $4='running') OR $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
-			 lease_expires_at=CASE WHEN $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
+			 lease_expires_at=CASE WHEN ($13::jsonb IS NOT NULL AND $4='running') OR $4 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                       THEN NULL ELSE lease_expires_at END,
 			 updated_at=now()
 			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3`,
@@ -2247,7 +2537,11 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "authorizationReconciliation"),
         patch.authorizationReconciliation ? JSON.stringify(patch.authorizationReconciliation) : null,
         Object.hasOwn(patch, "adapterReconciliation"),
-        patch.adapterReconciliation ? JSON.stringify(patch.adapterReconciliation) : null
+        patch.adapterReconciliation ? JSON.stringify(patch.adapterReconciliation) : null,
+        Object.hasOwn(patch, "pendingCompletion"),
+        patch.pendingCompletion ? JSON.stringify(patch.pendingCompletion) : null,
+        Object.hasOwn(patch, "externalCompletion"),
+        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null
       ]
     );
   }
@@ -2600,6 +2894,9 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
     if (input.spaceId) add("space_id=?", input.spaceId);
     if (input.statuses?.length) add("status = ANY(?::text[])", [...input.statuses]);
     if (input.updatedBefore) add("updated_at<?", input.updatedBefore);
+    if (input.awaitingCompletion || input.completionDueBefore) conditions.push("pending_completion IS NOT NULL");
+    if (input.completionDueBefore) add("completion_due_at <= ?", input.completionDueBefore);
+    if (input.unleased) conditions.push("lease_owner IS NULL");
     values.push(Math.max(1, Math.min(input.limit ?? 100, 1e3)));
     const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
     const result = await this.sql.query(
@@ -2697,9 +2994,12 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 			 error=CASE WHEN $8::boolean THEN $9 ELSE error END,
 			 authorization_reconciliation=CASE WHEN $10::boolean THEN $11::jsonb ELSE authorization_reconciliation END,
 			 adapter_reconciliation=CASE WHEN $12::boolean THEN $13::jsonb ELSE adapter_reconciliation END,
-			 lease_owner=CASE WHEN $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
+			 pending_completion=CASE WHEN $14::boolean THEN $15::jsonb ELSE pending_completion END,
+			 completion_due_at=CASE WHEN $14::boolean THEN ($15::jsonb->>'dueAt')::timestamptz ELSE completion_due_at END,
+			 external_completion=CASE WHEN $16::boolean THEN $17::jsonb ELSE external_completion END,
+			 lease_owner=CASE WHEN ($15::jsonb IS NOT NULL AND $6='running') OR $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                  THEN NULL ELSE lease_owner END,
-			 lease_expires_at=CASE WHEN $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
+			 lease_expires_at=CASE WHEN ($15::jsonb IS NOT NULL AND $6='running') OR $6 IN ('waiting_for_approval','completed','failed','blocked_by_policy','reconciliation_required','validation_failed')
 			                       THEN NULL ELSE lease_expires_at END,
 			 updated_at=now()
 			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3
@@ -2718,7 +3018,11 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         Object.hasOwn(patch, "authorizationReconciliation"),
         patch.authorizationReconciliation ? JSON.stringify(patch.authorizationReconciliation) : null,
         Object.hasOwn(patch, "adapterReconciliation"),
-        patch.adapterReconciliation ? JSON.stringify(patch.adapterReconciliation) : null
+        patch.adapterReconciliation ? JSON.stringify(patch.adapterReconciliation) : null,
+        Object.hasOwn(patch, "pendingCompletion"),
+        patch.pendingCompletion ? JSON.stringify(patch.pendingCompletion) : null,
+        Object.hasOwn(patch, "externalCompletion"),
+        patch.externalCompletion ? JSON.stringify(patch.externalCompletion) : null
       ]
     );
     return result.rows.length === 1;
@@ -2779,6 +3083,20 @@ function toAdapterRecord(row) {
     updatedAt: new Date(row.updated_at)
   };
 }
+function toPendingCompletion(value) {
+  return {
+    ...value,
+    acceptedAt: new Date(value.acceptedAt),
+    ...value.dueAt ? { dueAt: new Date(value.dueAt) } : {},
+    ...value.parkedAt ? { parkedAt: new Date(value.parkedAt) } : {}
+  };
+}
+function toExternalCompletion(value) {
+  return {
+    ...value,
+    recordedAt: new Date(value.recordedAt)
+  };
+}
 function toActionRecord(row) {
   return {
     id: String(row.id),
@@ -2803,6 +3121,8 @@ function toActionRecord(row) {
     ...row.execution_reason ? { executionReason: String(row.execution_reason) } : {},
     ...row.authorization_reconciliation ? { authorizationReconciliation: row.authorization_reconciliation } : {},
     ...row.adapter_reconciliation ? { adapterReconciliation: row.adapter_reconciliation } : {},
+    ...row.pending_completion ? { pendingCompletion: toPendingCompletion(row.pending_completion) } : {},
+    ...row.external_completion ? { externalCompletion: toExternalCompletion(row.external_completion) } : {},
     ...row.authorization_binding_id ? { authorizationBindingId: String(row.authorization_binding_id) } : {},
     attemptCount: Number(row.attempt_count ?? 0),
     leaseToken: Number(row.lease_token ?? 0),
@@ -2933,6 +3253,16 @@ function createStoreBackedActionDispatcher() {
 async function runPlatformActionWorkerCycle(options) {
   const leaseDurationMs = options.leaseDurationMs ?? DEFAULT_LEASE_DURATION_MS;
   emitWorkerTelemetry(options.telemetry, "worker.cycle.started", options.workerId);
+  if (options.sweepOverdueCompletions !== false && typeof options.host.reconcileOverdueCompletions === "function") {
+    try {
+      await options.host.reconcileOverdueCompletions({
+        ...options.tenantId ? { tenantId: options.tenantId } : {},
+        ...options.spaceId ? { spaceId: options.spaceId } : {}
+      });
+    } catch (error) {
+      options.onError?.(error);
+    }
+  }
   let claimed;
   try {
     claimed = await options.store.claimActionInvocations({
@@ -3195,6 +3525,7 @@ function createDurableSagaParentLifecycle(options) {
   };
 }
 
+exports.ExternalCompletionError = ExternalCompletionError;
 exports.IdempotencyConflictError = IdempotencyConflictError;
 exports.MemoryPlatformHostStore = MemoryPlatformHostStore;
 exports.PARAMETER_DIGEST_ALGORITHM = PARAMETER_DIGEST_ALGORITHM;