@fabricorg/platform-host 7.2.3 → 7.4.0

package/dist/index.cjs

@@ -1,8 +1,10 @@
 'use strict';
 
 var platform = require('@fabricorg/platform');
+var perf_hooks = require('perf_hooks');
 var assembly = require('@fabricorg/assembly');
 var crypto = require('crypto');
+var util = require('util');
 
 // src/host.ts
 
@@ -17,6 +19,19 @@ var IdempotencyConflictError = class extends Error {
   conflict;
   code = "IDEMPOTENCY_CONFLICT";
 };
+var ActionAdmissionError = class extends Error {
+  constructor(actionId, refusal, refusalCode) {
+    super(`Action ${actionId} submission was not admitted (${refusal}${refusalCode ? `: ${refusalCode}` : ""}); nothing was recorded.`);
+    this.actionId = actionId;
+    this.refusal = refusal;
+    this.refusalCode = refusalCode;
+    this.name = "ActionAdmissionError";
+  }
+  actionId;
+  refusal;
+  refusalCode;
+  code = "ACTION_ADMISSION_REFUSED";
+};
 var ExternalCompletionError = class extends Error {
   constructor(refusal, message) {
     super(message);
@@ -30,18 +45,8 @@ var ExternalCompletionError = class extends Error {
   }
 };
 var PARAMETER_DIGEST_ALGORITHM = "fabric-canonical-json-sha256-v1";
-function canonicalJson(value) {
-  return JSON.stringify(sort(value));
-}
-function sort(value) {
-  if (Array.isArray(value)) return value.map(sort);
-  if (value && typeof value === "object") {
-    return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([key, child]) => [key, sort(child)]));
-  }
-  return value;
-}
 function digestParameters(parameters) {
-  return crypto.createHash("sha256").update(canonicalJson(parameters)).digest("hex");
+  return crypto.createHash("sha256").update(platform.canonicalJson(parameters)).digest("hex");
 }
 var ATTRIBUTE_NAME = /^[a-z][a-z0-9-]*(?:\.[A-Za-z][A-Za-z0-9_-]*)+$/;
 var INVOCATION_SOURCE = /^(?:ui|sdui|api|agent|worker|system|[a-z][a-z0-9-]*(?:\.[a-z][a-z0-9-]*)+)$/;
@@ -84,6 +89,7 @@ var PLATFORM_HOST_METRIC_NAMES = {
   workerCyclesCompleted: "fabric.platform.worker.cycles.completed",
   workerCyclesFailed: "fabric.platform.worker.cycles.failed",
   invocationSubmitted: "fabric.platform.invocation.submitted",
+  invocationAdmissionRefused: "fabric.platform.invocation.admission_refused",
   invocationExecutionStarted: "fabric.platform.invocation.execution_started",
   invocationLeaseClaimed: "fabric.platform.invocation.lease_claimed",
   invocationCompleted: "fabric.platform.invocation.completed",
@@ -99,6 +105,8 @@ var PLATFORM_HOST_METRIC_NAMES = {
   outboxPublished: "fabric.platform.outbox.published",
   outboxFailed: "fabric.platform.outbox.failed",
   outboxDeadLettered: "fabric.platform.outbox.dead_lettered",
+  outboxRequeued: "fabric.platform.outbox.requeued",
+  outboxRequeueRefused: "fabric.platform.outbox.requeue_refused",
   invocationBacklog: "fabric.platform.invocation.backlog",
   invocationRunning: "fabric.platform.invocation.running",
   invocationExpiredLeases: "fabric.platform.invocation.expired_leases",
@@ -439,7 +447,7 @@ function createExternalCompletionLifecycle(deps) {
     return withConsistency(actionResult2({ ...invocation, ...patch }), invocation.actionId);
   }
   function completionDigest(completion, provider) {
-    return crypto.createHash("sha256").update(canonicalJson({
+    return crypto.createHash("sha256").update(platform.canonicalJson({
       provider: provider ?? null,
       externalReference: completion.externalReference,
       outcome: completion.outcome,
@@ -498,6 +506,340 @@ function createExternalCompletionLifecycle(deps) {
   }
   return { completeExternalInvocation, reconcileOverdueCompletions, recordCompletionReconciliation };
 }
+var SubmissionUnreadableError = class extends Error {
+  name = "SubmissionUnreadableError";
+  constructor() {
+    super("Platform Host submission could not be read as plain data; nothing was recorded.");
+  }
+};
+var NotJsonData = class extends Error {
+};
+function copyJsonData(value) {
+  try {
+    return { ok: true, value: copy(value, /* @__PURE__ */ new Set()) };
+  } catch {
+    return { ok: false };
+  }
+}
+function copy(value, ancestors) {
+  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+  if (typeof value === "number") {
+    if (!Number.isFinite(value)) throw new NotJsonData();
+    return value === 0 ? 0 : value;
+  }
+  if (typeof value !== "object") throw new NotJsonData();
+  if (util.types.isProxy(value)) throw new NotJsonData();
+  if (ancestors.has(value)) throw new NotJsonData();
+  const prototype = Reflect.getPrototypeOf(value);
+  ancestors.add(value);
+  try {
+    if (Array.isArray(value)) {
+      if (prototype !== Array.prototype) throw new NotJsonData();
+      const length = value.length;
+      const out2 = [];
+      for (let index = 0; index < length; index += 1) {
+        const descriptor = Reflect.getOwnPropertyDescriptor(value, String(index));
+        if (descriptor === void 0) throw new NotJsonData();
+        const item = readOnce(value, descriptor);
+        if (item === void 0) throw new NotJsonData();
+        out2.push(copy(item, ancestors));
+      }
+      return out2;
+    }
+    if (prototype !== Object.prototype && prototype !== null) throw new NotJsonData();
+    const out = {};
+    for (const key of Reflect.ownKeys(value)) {
+      if (typeof key !== "string") continue;
+      const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+      if (descriptor === void 0 || descriptor.enumerable !== true) continue;
+      const item = readOnce(value, descriptor);
+      if (item === void 0) continue;
+      Reflect.defineProperty(out, key, { value: copy(item, ancestors), enumerable: true, writable: true, configurable: true });
+    }
+    return out;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function readOnce(target, descriptor) {
+  if ("value" in descriptor) return descriptor.value;
+  return descriptor.get ? Reflect.apply(descriptor.get, target, []) : void 0;
+}
+function snapshotSubmission(input) {
+  if (input === null || typeof input !== "object") throw new SubmissionUnreadableError();
+  const scalar = (key) => primitiveOrAbsent(readField(input, key));
+  const actionId = scalar("actionId");
+  const tenantId = scalar("tenantId");
+  const spaceId = scalar("spaceId");
+  const actorId = scalar("actorId");
+  const actorType = scalar("actorType");
+  const correlationId = scalar("correlationId");
+  const causationId = scalar("causationId");
+  const executionReason = scalar("executionReason");
+  const idempotencyKey = scalar("idempotencyKey");
+  const authorizationBindingId = scalar("authorizationBindingId");
+  const scalars = {
+    actionId,
+    tenantId,
+    spaceId,
+    actorId,
+    actorType,
+    ...correlationId != null ? { correlationId } : {},
+    ...causationId != null ? { causationId } : {},
+    ...executionReason != null ? { executionReason } : {},
+    ...idempotencyKey != null ? { idempotencyKey } : {},
+    ...authorizationBindingId != null ? { authorizationBindingId } : {}
+  };
+  const live = { ...scalars, parametersArePrivate: false };
+  Object.defineProperties(live, {
+    parameters: { get: () => input.parameters, enumerable: true },
+    provenance: { get: () => input.provenance, enumerable: true },
+    authorizationBinding: { get: () => input.authorizationBinding, enumerable: true }
+  });
+  return Object.freeze(live);
+}
+var PROVENANCE_SCALARS = ["source", "correlationId", "causationId"];
+var PROVENANCE_ATTRIBUTES = ["traceAttributes", "auditAttributes"];
+var BINDING_FIELDS = ["id", "tenantId", "actorId", "actionId", "parameterDigest", "resourceScope", "capturedAt", "expiresAt", "governingMoment"];
+function privateSubmission(snapshot) {
+  const parameters = readField(snapshot, "parameters");
+  const provenanceRead = readField(snapshot, "provenance");
+  const bindingRead = readField(snapshot, "authorizationBinding");
+  const copied = copyJsonData(parameters);
+  const provenance = provenanceRead ? copyProvenance(provenanceRead) : void 0;
+  const authorizationBinding = bindingRead ? copyBinding(bindingRead) : void 0;
+  return Object.freeze({
+    actionId: snapshot.actionId,
+    tenantId: snapshot.tenantId,
+    spaceId: snapshot.spaceId,
+    actorId: snapshot.actorId,
+    actorType: snapshot.actorType,
+    ...snapshot.correlationId !== void 0 ? { correlationId: snapshot.correlationId } : {},
+    ...snapshot.causationId !== void 0 ? { causationId: snapshot.causationId } : {},
+    ...snapshot.executionReason !== void 0 ? { executionReason: snapshot.executionReason } : {},
+    ...snapshot.idempotencyKey !== void 0 ? { idempotencyKey: snapshot.idempotencyKey } : {},
+    ...snapshot.authorizationBindingId !== void 0 ? { authorizationBindingId: snapshot.authorizationBindingId } : {},
+    ...provenance ? { provenance } : {},
+    ...authorizationBinding ? { authorizationBinding } : {},
+    parameters: copied.ok ? copied.value : parameters,
+    parametersArePrivate: copied.ok
+  });
+}
+function readField(target, key) {
+  try {
+    return target[key];
+  } catch {
+    throw new SubmissionUnreadableError();
+  }
+}
+function primitiveOrAbsent(value) {
+  if (value !== null && (typeof value === "object" || typeof value === "function" || typeof value === "symbol")) {
+    throw new SubmissionUnreadableError();
+  }
+  return value;
+}
+function objectOf(value) {
+  if (value === null || typeof value !== "object") throw new SubmissionUnreadableError();
+  return value;
+}
+function copyFields(source, fields) {
+  const out = {};
+  for (const field of fields) {
+    const value = primitiveOrAbsent(readField(source, field));
+    if (value !== void 0) out[field] = value;
+  }
+  return out;
+}
+function copyAttributes(source, field) {
+  const value = readField(source, field);
+  if (value === void 0 || value === null) return void 0;
+  const map = objectOf(value);
+  let entries;
+  try {
+    entries = Object.entries(map);
+  } catch {
+    throw new SubmissionUnreadableError();
+  }
+  const out = {};
+  for (const [key, item] of entries) {
+    Reflect.defineProperty(out, key, { value: primitiveOrAbsent(item), enumerable: true, writable: true, configurable: true });
+  }
+  return out;
+}
+function copyProvenance(value) {
+  const source = objectOf(value);
+  const out = copyFields(source, PROVENANCE_SCALARS);
+  for (const field of PROVENANCE_ATTRIBUTES) {
+    const attributes = copyAttributes(source, field);
+    if (attributes !== void 0) out[field] = attributes;
+  }
+  return out;
+}
+function copyBinding(value) {
+  return copyFields(objectOf(value), BINDING_FIELDS);
+}
+function parametersCopy(snapshot) {
+  if (!snapshot.parametersArePrivate) throw new SubmissionUnreadableError();
+  const copied = copyJsonData(snapshot.parameters);
+  if (!copied.ok) throw new SubmissionUnreadableError();
+  return copied.value;
+}
+function liveSubmissionView(snapshot, input) {
+  const view = {
+    actionId: snapshot.actionId,
+    tenantId: snapshot.tenantId,
+    spaceId: snapshot.spaceId,
+    actorId: snapshot.actorId,
+    actorType: snapshot.actorType,
+    ...snapshot.correlationId !== void 0 ? { correlationId: snapshot.correlationId } : {},
+    ...snapshot.causationId !== void 0 ? { causationId: snapshot.causationId } : {},
+    ...snapshot.executionReason !== void 0 ? { executionReason: snapshot.executionReason } : {},
+    ...snapshot.idempotencyKey !== void 0 ? { idempotencyKey: snapshot.idempotencyKey } : {},
+    ...snapshot.authorizationBindingId !== void 0 ? { authorizationBindingId: snapshot.authorizationBindingId } : {}
+  };
+  const caller = input;
+  for (const field of ["parameters", "provenance", "authorizationBinding"]) {
+    Object.defineProperty(view, field, {
+      get: () => caller[field],
+      set: (value) => {
+        caller[field] = value;
+      },
+      enumerable: true,
+      configurable: true
+    });
+  }
+  return view;
+}
+function submissionView(snapshot) {
+  const fresh = (value) => {
+    if (value === void 0) return void 0;
+    const copied = copyJsonData(value);
+    if (!copied.ok) throw new SubmissionUnreadableError();
+    return copied.value;
+  };
+  const provenance = fresh(snapshot.provenance);
+  const authorizationBinding = fresh(snapshot.authorizationBinding);
+  return {
+    actionId: snapshot.actionId,
+    parameters: parametersCopy(snapshot),
+    tenantId: snapshot.tenantId,
+    spaceId: snapshot.spaceId,
+    actorId: snapshot.actorId,
+    actorType: snapshot.actorType,
+    ...snapshot.correlationId !== void 0 ? { correlationId: snapshot.correlationId } : {},
+    ...snapshot.causationId !== void 0 ? { causationId: snapshot.causationId } : {},
+    ...provenance ? { provenance } : {},
+    ...snapshot.executionReason !== void 0 ? { executionReason: snapshot.executionReason } : {},
+    ...snapshot.idempotencyKey !== void 0 ? { idempotencyKey: snapshot.idempotencyKey } : {},
+    ...snapshot.authorizationBindingId !== void 0 ? { authorizationBindingId: snapshot.authorizationBindingId } : {},
+    ...authorizationBinding ? { authorizationBinding } : {}
+  };
+}
+var MAX_REASON_LENGTH = 1e3;
+function asOutboxRequeueStore(store) {
+  const candidate = store;
+  return typeof candidate.requeueOutboxDeadLetter === "function" && typeof candidate.getOutboxRecord === "function" && typeof candidate.listOutboxRequeues === "function" ? store : void 0;
+}
+function createOutboxRequeue(deps) {
+  return async function requeueOutboxDeadLetter(input) {
+    for (const field of ["outboxId", "tenantId", "spaceId", "actorId", "actorType"]) {
+      if (typeof input[field] !== "string" || input[field].trim() === "") {
+        throw new Error(`Outbox requeue requires ${field}.`);
+      }
+    }
+    if (typeof input.reason !== "string" || input.reason.trim() === "") {
+      throw new Error("Outbox requeue requires a reason.");
+    }
+    if (input.reason.length > MAX_REASON_LENGTH) {
+      throw new Error(`Outbox requeue reason must be at most ${MAX_REASON_LENGTH} characters.`);
+    }
+    if (input.availableAt !== void 0 && !(input.availableAt instanceof Date && Number.isFinite(input.availableAt.getTime()))) {
+      throw new Error("Outbox requeue availableAt must be a valid Date.");
+    }
+    const store = asOutboxRequeueStore(deps.store);
+    if (!store) throw new Error("Outbox requeue requires a store with outbox requeue support.");
+    const refuse = (refusal, message, currentStatus) => {
+      emitPlatformHostTelemetry(deps.telemetry, {
+        kind: "event",
+        name: "outbox.requeue_refused",
+        metricName: PLATFORM_HOST_METRIC_NAMES.outboxRequeueRefused,
+        occurredAt: deps.now(),
+        tenantId: input.tenantId,
+        spaceId: input.spaceId,
+        attributes: { refusal }
+      });
+      return { status: "refused", refusal, message, ...currentStatus ? { currentStatus } : {} };
+    };
+    const record = await store.getOutboxRecord(input.outboxId, input.tenantId, input.spaceId);
+    const authorization = deps.authorization;
+    const hasAuthorizer = typeof authorization.authorizeOutboxRequeue === "function";
+    const authorized = hasAuthorizer ? await authorization.authorizeOutboxRequeue({
+      tenantId: input.tenantId,
+      spaceId: input.spaceId,
+      actorId: input.actorId,
+      actorType: input.actorType,
+      outboxId: input.outboxId,
+      reason: input.reason,
+      ...record ? {
+        record: {
+          eventId: record.event.eventId,
+          eventType: record.event.eventType,
+          payloadClassification: record.event.payloadClassification,
+          status: record.status,
+          attemptCount: record.attemptCount
+        }
+      } : {}
+    }) : false;
+    if (authorized !== true) {
+      return refuse(
+        "not_authorized",
+        hasAuthorizer ? `Actor ${input.actorId} is not authorized to requeue outbox records in this scope.` : "Outbox requeue is refused because no authorizeOutboxRequeue is configured."
+      );
+    }
+    if (!record) return refuse("not_found", `Outbox record not found: ${input.outboxId}`);
+    if (record.status !== "dead_letter") {
+      return refuse("not_dead_letter", `Outbox record ${input.outboxId} is ${record.status}, not dead_letter.`, record.status);
+    }
+    const requeuedAt = deps.now();
+    const result = await store.requeueOutboxDeadLetter({
+      id: input.outboxId,
+      tenantId: input.tenantId,
+      spaceId: input.spaceId,
+      requeueId: platform.createFabricId("orq"),
+      actorId: input.actorId,
+      actorType: input.actorType,
+      reason: input.reason,
+      requeuedAt,
+      availableAt: input.availableAt ?? requeuedAt,
+      expectedLeaseToken: record.leaseToken ?? 0
+    });
+    if (!result.applied) {
+      if (result.refusal === "not_found") return refuse("not_found", `Outbox record not found: ${input.outboxId}`);
+      if (result.refusal === "stale") {
+        return refuse(
+          "stale",
+          `Outbox record ${input.outboxId} changed after it was authorized; read and authorize it again.`,
+          result.currentStatus
+        );
+      }
+      return refuse(
+        "not_dead_letter",
+        `Outbox record ${input.outboxId} is ${result.currentStatus ?? "no longer dead_letter"}, not dead_letter.`,
+        result.currentStatus
+      );
+    }
+    emitPlatformHostTelemetry(deps.telemetry, {
+      kind: "event",
+      name: "outbox.requeued",
+      metricName: PLATFORM_HOST_METRIC_NAMES.outboxRequeued,
+      occurredAt: requeuedAt,
+      tenantId: input.tenantId,
+      spaceId: input.spaceId,
+      attributes: { priorAttempt: result.requeue.priorAttemptCount }
+    });
+    return { status: "requeued", record: result.record, requeue: result.requeue };
+  };
+}
 
 // src/host.ts
 var DEFAULT_EXTRACT_EVENTS = (data) => {
@@ -507,6 +849,12 @@ var DEFAULT_EXTRACT_EVENTS = (data) => {
 var RecoverableFinalizationError = class extends Error {
   name = "RecoverableFinalizationError";
 };
+var DEFAULT_ADMISSION_TIMEOUT_MS = 1e4;
+var MAX_TIMER_MS = 2147483647;
+var monotonicNow = perf_hooks.performance.now.bind(perf_hooks.performance);
+var ADMISSION_FAILED = Object.freeze({ kind: "failed" });
+var ADMISSION_TIMED_OUT = Object.freeze({ kind: "timed_out" });
+var ADMISSION_REFUSAL_CODE = /^[a-z][A-Za-z0-9_.:-]{0,127}$/;
 function createGovernedActionHost(options) {
   if (options.composition) {
     if (!options.registry?.orderedModules) {
@@ -528,45 +876,63 @@ function createGovernedActionHost(options) {
     }
   }
   const adapters = new platform.AdapterRegistry();
-  for (const adapter of options.adapters ?? []) adapters.register(adapter);
+  for (const adapter of options.adapters ?? []) {
+    if (adapter.circuitBreaker) platform.assertAdapterCircuitBreakerConfig(adapter.circuitBreaker);
+    adapters.register(adapter);
+  }
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
+  const circuitBreakers = options.adapterCircuitBreakers ?? new platform.AdapterCircuitBreakerRegistry({ now: () => now().getTime() });
   const extractEvents = options.extractEvents ?? DEFAULT_EXTRACT_EVENTS;
   const configuredActionResolver = options.resolveAction ?? options.registry?.resolveAction;
   if (!configuredActionResolver) throw new Error("Platform Host requires an explicit module registry or resolveAction function.");
   const actionResolver = configuredActionResolver;
   const stateMachineResolver = options.registry?.resolveStateMachine ?? (() => void 0);
   const eventResultFields = options.eventResultFields ?? ["_events"];
+  const admissionTimeoutMs = options.admissionTimeoutMs ?? DEFAULT_ADMISSION_TIMEOUT_MS;
+  if (typeof admissionTimeoutMs !== "number" || !Number.isInteger(admissionTimeoutMs) || admissionTimeoutMs < 1 || admissionTimeoutMs > MAX_TIMER_MS) {
+    throw new Error(`admissionTimeoutMs must be a whole number of milliseconds from 1 to ${MAX_TIMER_MS}.`);
+  }
   async function submitAction(input) {
-    if (input.executionReason && !["initial", "offline_replay"].includes(input.executionReason)) {
-      throw new Error(`Unsupported submitted execution reason: ${input.executionReason}`);
+    const read = snapshotSubmission(input);
+    if (read.executionReason && !["initial", "offline_replay"].includes(read.executionReason)) {
+      throw new Error(`Unsupported submitted execution reason: ${read.executionReason}`);
     }
-    const action = actionResolver(input.actionId);
-    if (!action) throw new Error(`Unknown action: ${input.actionId}`);
-    if (action.execution?.connectivity === "online-required" && input.executionReason === "offline_replay") {
-      throw new Error(`Action ${input.actionId} is online-required and cannot be submitted as an offline replay.`);
+    const action = actionResolver(read.actionId);
+    if (!action) throw new Error(`Unknown action: ${read.actionId}`);
+    const declaresAdmission = action.admitSubmission !== void 0;
+    const submission = declaresAdmission ? privateSubmission(read) : read;
+    if (action.execution?.connectivity === "online-required" && submission.executionReason === "offline_replay") {
+      throw new Error(`Action ${submission.actionId} is online-required and cannot be submitted as an offline replay.`);
     }
-    if (action.execution?.sensitivity === "restricted" && Object.keys(input.provenance?.auditAttributes ?? {}).length > 0) {
-      throw new Error(`Action ${input.actionId} declares restricted sensitivity; provenance audit attributes must not be durably recorded.`);
+    if (action.execution?.sensitivity === "restricted" && Object.keys(submission.provenance?.auditAttributes ?? {}).length > 0) {
+      throw new Error(`Action ${submission.actionId} declares restricted sensitivity; provenance audit attributes must not be durably recorded.`);
     }
-    const authorizationInput = toAuthorizationInput(action, input);
+    const authorizationInput = toAuthorizationInput(action, submission);
     if (!await options.authorization.checkEntitlement(authorizationInput)) {
-      throw new Error(`Module "${action.namespace}" is not enabled for tenant ${input.tenantId}`);
+      throw new Error(`Module "${action.namespace}" is not enabled for tenant ${submission.tenantId}`);
     }
     if (!await options.authorization.authorize(authorizationInput)) {
-      throw new Error(`Actor ${input.actorId} is not authorized for action ${input.actionId}`);
+      throw new Error(`Actor ${submission.actorId} is not authorized for action ${submission.actionId}`);
+    }
+    if (declaresAdmission && (!submission.parametersArePrivate || !isRecord(submission.parameters))) {
+      refuseAdmission(action, submission, "invalid_parameters");
     }
     const actionInvocationId = platform.createFabricId("act");
-    if (input.correlationId && input.provenance?.correlationId && input.correlationId !== input.provenance.correlationId) throw new Error("Invocation provenance correlationId does not match submission correlationId.");
-    if (input.causationId && input.provenance?.causationId && input.causationId !== input.provenance.causationId) throw new Error("Invocation provenance causationId does not match submission causationId.");
-    const correlationId = input.correlationId ?? input.provenance?.correlationId ?? platform.createFabricId("corr");
-    const durableParameters = options.redactActionParameters ? options.redactActionParameters(input.actionId, input.parameters) : input.parameters;
-    const parameterDigest = digestParameters(input.parameters);
-    if (input.authorizationBinding) validateAuthorizationBinding(input, parameterDigest, action.execution?.authorityMoment, now());
+    if (submission.correlationId && submission.provenance?.correlationId && submission.correlationId !== submission.provenance.correlationId) throw new Error("Invocation provenance correlationId does not match submission correlationId.");
+    if (submission.causationId && submission.provenance?.causationId && submission.causationId !== submission.provenance.causationId) throw new Error("Invocation provenance causationId does not match submission causationId.");
+    const correlationId = submission.correlationId ?? submission.provenance?.correlationId ?? platform.createFabricId("corr");
+    const prepare = () => {
+      const durableParameters2 = options.redactActionParameters ? options.redactActionParameters(submission.actionId, submission.parameters) : submission.parameters;
+      const parameterDigest2 = digestParameters(submission.parameters);
+      if (submission.authorizationBinding) validateAuthorizationBinding(submission, parameterDigest2, action.execution?.authorityMoment, now());
+      return { durableParameters: durableParameters2, parameterDigest: parameterDigest2 };
+    };
+    const early = declaresAdmission ? void 0 : prepare();
     const durableProvenance = normalizeProvenance(
-      input.provenance,
+      submission.provenance,
       options.provenance
     );
-    const initiatingReleaseDigest = await options.composition?.resolveInitiatingReleaseDigest?.(input);
+    const initiatingReleaseDigest = await options.composition?.resolveInitiatingReleaseDigest?.(declaresAdmission ? submissionView(submission) : liveSubmissionView(submission, input));
     const runtimeEvidence = {
       governanceContractVersion: platform.FABRIC_GOVERNANCE_CONTRACT_VERSION,
       hostContractVersion: PLATFORM_HOST_CONTRACT_VERSION,
@@ -575,48 +941,51 @@ function createGovernedActionHost(options) {
       ...initiatingReleaseDigest ? { initiatingReleaseDigest } : {}
     };
     platform.assertGovernanceRuntimeEvidence(runtimeEvidence);
+    const admission = declaresAdmission ? await admitSubmission(action, submission) : void 0;
+    const { durableParameters, parameterDigest } = early ?? prepare();
     const durableInvocation = await options.store.createActionInvocation({
       id: actionInvocationId,
-      tenantId: input.tenantId,
-      spaceId: input.spaceId,
-      actionId: input.actionId,
+      tenantId: submission.tenantId,
+      spaceId: submission.spaceId,
+      actionId: submission.actionId,
       actionVersion: action.version,
-      actorId: input.actorId,
-      actorType: input.actorType,
+      actorId: submission.actorId,
+      actorType: submission.actorType,
       status: "pending",
       parameters: durableParameters,
       result: {},
       runtimeEvidence,
       correlationId,
-      ...input.causationId ?? input.provenance?.causationId ? { causationId: input.causationId ?? input.provenance?.causationId } : {},
-      ...input.idempotencyKey ? { idempotencyKey: input.idempotencyKey } : {},
-      ...input.idempotencyKey ? {
+      ...submission.causationId ?? submission.provenance?.causationId ? { causationId: submission.causationId ?? submission.provenance?.causationId } : {},
+      ...submission.idempotencyKey ? { idempotencyKey: submission.idempotencyKey } : {},
+      ...submission.idempotencyKey ? {
         parameterDigest,
         parameterDigestAlgorithm: PARAMETER_DIGEST_ALGORITHM,
-        idempotencyActorId: input.actorId,
-        ...input.authorizationBindingId ? { idempotencyAuthorizationBindingId: input.authorizationBindingId } : {}
+        idempotencyActorId: submission.actorId,
+        ...submission.authorizationBindingId ? { idempotencyAuthorizationBindingId: submission.authorizationBindingId } : {}
       } : {},
       ...durableProvenance ? { provenance: durableProvenance } : {},
-      ...input.authorizationBinding ? { authorizationBinding: input.authorizationBinding } : {},
-      ...input.executionReason ? { executionReason: input.executionReason } : {},
-      ...input.authorizationBindingId ? { authorizationBindingId: input.authorizationBindingId } : {}
+      ...submission.authorizationBinding ? { authorizationBinding: submission.authorizationBinding } : {},
+      ...submission.executionReason ? { executionReason: submission.executionReason } : {},
+      ...submission.authorizationBindingId ? { authorizationBindingId: submission.authorizationBindingId } : {},
+      ...admission ? { admittedAt: admission.admittedAt } : {}
     });
     emitPlatformHostTelemetry(options.telemetry, {
       kind: "event",
       name: "invocation.submitted",
       metricName: PLATFORM_HOST_METRIC_NAMES.invocationSubmitted,
       occurredAt: now(),
-      tenantId: input.tenantId,
-      spaceId: input.spaceId,
+      tenantId: submission.tenantId,
+      spaceId: submission.spaceId,
       attributes: { actionVersion: action.version }
     });
-    if (durableInvocation.id !== actionInvocationId && input.idempotencyKey) {
+    if (durableInvocation.id !== actionInvocationId && submission.idempotencyKey) {
       const conflict = idempotencyConflict(durableInvocation, {
-        actorId: input.actorId,
-        authorizationBindingId: input.authorizationBindingId,
+        actorId: submission.actorId,
+        authorizationBindingId: submission.authorizationBindingId,
         actionVersion: action.version,
         parameterDigest,
-        idempotencyKey: input.idempotencyKey
+        idempotencyKey: submission.idempotencyKey
       });
       if (!durableInvocation.parameterDigest) {
         options.idempotency?.onLegacyRecord?.(durableInvocation);
@@ -636,8 +1005,8 @@ function createGovernedActionHost(options) {
         const dispatched = await options.dispatcher.dispatch({
           actionInvocationId: durableInvocation.id,
           actionId: durableInvocation.actionId,
-          tenantId: input.tenantId,
-          spaceId: input.spaceId,
+          tenantId: submission.tenantId,
+          spaceId: submission.spaceId,
           workflowId: durableWorkflowId
         });
         return withConsistency({
@@ -647,7 +1016,7 @@ function createGovernedActionHost(options) {
           ...dispatched.runId ? { runId: dispatched.runId } : {},
           ...durableInvocation.hitlRoute ? { hitlRoute: durableInvocation.hitlRoute } : {},
           ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {}
-        }, input.actionId);
+        }, submission.actionId);
       }
       return withConsistency({
         actionInvocationId: durableInvocation.id,
@@ -660,15 +1029,15 @@ function createGovernedActionHost(options) {
         ...durableInvocation.authorizationReconciliation ? { reconciliation: durableInvocation.authorizationReconciliation } : {},
         ...durableInvocation.adapterReconciliation ? { adapterReconciliation: durableInvocation.adapterReconciliation } : {},
         ...durableInvocation.pendingCompletion ? { pendingCompletion: durableInvocation.pendingCompletion } : {}
-      }, input.actionId);
+      }, submission.actionId);
     }
     if (options.dispatcher) {
       try {
         const dispatched = await options.dispatcher.dispatch({
           actionInvocationId: durableInvocation.id,
           actionId: durableInvocation.actionId,
-          tenantId: input.tenantId,
-          spaceId: input.spaceId,
+          tenantId: submission.tenantId,
+          spaceId: submission.spaceId,
           workflowId: durableWorkflowId
         });
         return withConsistency({
@@ -678,17 +1047,78 @@ function createGovernedActionHost(options) {
           ...dispatched.runId ? { runId: dispatched.runId } : {},
           ...durableInvocation.hitlRoute ? { hitlRoute: durableInvocation.hitlRoute } : {},
           ...durableInvocation.hitlRiskTier ? { hitlRiskTier: durableInvocation.hitlRiskTier } : {}
-        }, input.actionId);
+        }, submission.actionId);
       } catch (error) {
         throw error;
       }
     }
     const executed = await executeInvocation(
       durableInvocation.id,
-      input.tenantId,
-      input.spaceId
+      submission.tenantId,
+      submission.spaceId
     );
-    return { ...withConsistency(executed, input.actionId), workflowId: durableWorkflowId };
+    return { ...withConsistency(executed, submission.actionId), workflowId: durableWorkflowId };
+  }
+  async function admitSubmission(action, submission) {
+    const refuse = (refusal, refusalCode) => refuseAdmission(action, submission, refusal, refusalCode);
+    const check = action.admitSubmission;
+    if (typeof check !== "function") return refuse("failed");
+    const checked = parametersCopy(submission);
+    const controller = new AbortController();
+    let timer;
+    const deadline = new Promise((resolve) => {
+      timer = setTimeout(() => {
+        controller.abort();
+        resolve(ADMISSION_TIMED_OUT);
+      }, admissionTimeoutMs);
+    });
+    const startedAt = monotonicNow();
+    const settledInTime = () => monotonicNow() - startedAt < admissionTimeoutMs;
+    let answered;
+    try {
+      answered = Promise.resolve(check(Object.freeze({
+        actionId: action.actionId,
+        tenantId: submission.tenantId,
+        spaceId: submission.spaceId,
+        actorId: submission.actorId,
+        actorType: submission.actorType,
+        parameters: checked,
+        signal: controller.signal
+      }))).then(
+        (value) => settledInTime() ? { kind: "answered", value } : ADMISSION_TIMED_OUT,
+        () => settledInTime() ? ADMISSION_FAILED : ADMISSION_TIMED_OUT
+      );
+    } catch {
+      answered = Promise.resolve(settledInTime() ? ADMISSION_FAILED : ADMISSION_TIMED_OUT);
+    }
+    let outcome;
+    try {
+      outcome = await Promise.race([answered, deadline]);
+    } finally {
+      clearTimeout(timer);
+    }
+    if (outcome.kind === "timed_out") {
+      controller.abort();
+      return refuse("timed_out");
+    }
+    if (outcome.kind === "failed") return refuse("failed");
+    const admitted = ownDataProperty(outcome.value, "admitted");
+    if (admitted === true) return { admittedAt: now() };
+    const code = ownDataProperty(outcome.value, "code");
+    if (admitted === false && typeof code === "string" && ADMISSION_REFUSAL_CODE.test(code)) return refuse("refused", code);
+    return refuse("invalid_decision");
+  }
+  function refuseAdmission(action, submission, refusal, refusalCode) {
+    emitPlatformHostTelemetry(options.telemetry, {
+      kind: "event",
+      name: "invocation.admission_refused",
+      metricName: PLATFORM_HOST_METRIC_NAMES.invocationAdmissionRefused,
+      occurredAt: now(),
+      tenantId: submission.tenantId,
+      spaceId: submission.spaceId,
+      attributes: { actionVersion: action.version, refusal }
+    });
+    throw new ActionAdmissionError(action.actionId, refusal, refusalCode);
   }
   async function executeInvocation(actionInvocationId, tenantId, spaceId, executionOptions = {}, executionReasonOverride) {
     const loadedInvocation = await options.store.getActionInvocation(
@@ -717,6 +1147,13 @@ function createGovernedActionHost(options) {
     if (!action) {
       return fail2(invocation, "failed", `Unknown action: ${invocation.actionId}`);
     }
+    if (action.admitSubmission !== void 0 && !isAdmissionTime(invocation.admittedAt)) {
+      return fail2(
+        invocation,
+        "failed",
+        `Invocation of ${action.actionId} was not admitted at submission; an action that declares admitSubmission runs only on invocations its check admitted.`
+      );
+    }
     if (action.kind === "saga") {
       return fail2(
         invocation,
@@ -884,6 +1321,10 @@ function createGovernedActionHost(options) {
       }
       const definitions = options.resolvePolicies ? await options.resolvePolicies({
         ...authorizationInput,
+        actionInvocationId,
+        parameters: parsed.data,
+        invocation,
+        executionReason,
         declaredPolicyIds: action.policies ?? []
       }) : declaredPolicies(action.policies ?? []);
       const outcomes = await platform.evaluatePolicyDefinitions(definitions, {
@@ -994,6 +1435,7 @@ function createGovernedActionHost(options) {
               correlationId: invocation.correlationId,
               ...invocation.causationId ? { causationId: invocation.causationId } : {},
               ...invocation.provenance ? { provenance: invocation.provenance } : {},
+              ...isAdmissionTime(invocation.admittedAt) ? { admittedAt: invocation.admittedAt } : {},
               db,
               services: options.services
             },
@@ -1121,14 +1563,20 @@ function createGovernedActionHost(options) {
             );
             adapterDeadlineTimer.unref?.();
           }
+          const circuitBreaker = circuitBreakers.forAdapter(adapter);
           const result2 = await platform.executeWithAdapterRetry({
+            ...circuitBreaker ? { circuitBreaker } : {},
             policy: step.retryPolicy ?? adapter.retryPolicy,
             defaultIdempotent: adapter.idempotent,
-            execute: async (attempt, maxAttempts) => {
+            // Every await before the call happens here, before breaker
+            // admission, so nothing awaits between admission and the adapter.
+            prepareAttempt: async (attempt) => {
               await options.store.updateAdapterInvocation(adapterInvocationId, {
                 attempt,
                 updatedAt: now()
               });
+            },
+            execute: (attempt, maxAttempts) => {
               return adapter.execute(input, {
                 tenantId,
                 spaceId,
@@ -1146,6 +1594,7 @@ function createGovernedActionHost(options) {
             getError: (result3) => result3.error,
             classifyOutcome: (result3) => result3.outcome ?? "transient_failure",
             classifyThrownError: (error) => {
+              if (platform.isAdapterCircuitOpenError(error)) return "transient_failure";
               if (adapterController?.signal.aborted) return "timeout";
               const message = error instanceof Error ? error.message : String(error);
               if (/timeout|deadline|timed?\s*out/i.test(message)) return "timeout";
@@ -1323,6 +1772,19 @@ function createGovernedActionHost(options) {
             error: message,
             updatedAt: now()
           });
+          if (platform.isAdapterCircuitOpenError(error)) {
+            await appendEvent(invocation, {
+              eventType: "AdapterInvocationFailed",
+              subjectType: adapterEventSubject.subjectType,
+              subjectId: adapterEventSubject.subjectId,
+              payload: {
+                adapterType: step.adapterType,
+                operation: step.operation,
+                reason: "circuit_open",
+                ...error.retryAfterMs !== void 0 ? { retryAfterMs: error.retryAfterMs } : {}
+              }
+            }, `adapter:${stepIndex}:failed`);
+          }
           return fail2(invocation, "failed", message);
         } finally {
           if (adapterDeadlineTimer) clearTimeout(adapterDeadlineTimer);
@@ -1576,6 +2038,8 @@ function createGovernedActionHost(options) {
         producerModuleVersion: options.outbox.producerModuleVersion(invocation.actionId, invocation.actionVersion),
         payloadClassification,
         includeProvenance: options.outbox.includeProvenance?.(envelope, payloadClassification) ?? payloadClassification !== "restricted",
+        // Actor identity is excluded for every classification unless the application opts in.
+        includeActor: options.outbox.includeActor?.(envelope, payloadClassification) === true,
         ...traceContext ? { traceContext } : {}
       };
       if (transaction) {
@@ -1645,7 +2109,13 @@ function createGovernedActionHost(options) {
     recordExecutionAttestation,
     recordExternalReconciliation,
     completeExternalInvocation: externalCompletion.completeExternalInvocation,
-    reconcileOverdueCompletions: externalCompletion.reconcileOverdueCompletions
+    reconcileOverdueCompletions: externalCompletion.reconcileOverdueCompletions,
+    requeueOutboxDeadLetter: createOutboxRequeue({
+      store: options.store,
+      authorization: options.authorization,
+      telemetry: options.telemetry,
+      now
+    })
   };
 }
 function actionResult(invocation) {
@@ -1707,6 +2177,18 @@ function isTerminal(status) {
 function isRecord(value) {
   return Boolean(value && typeof value === "object" && !Array.isArray(value));
 }
+function isAdmissionTime(value) {
+  return value instanceof Date && Number.isFinite(value.getTime());
+}
+function ownDataProperty(value, key) {
+  if (value === null || typeof value !== "object") return void 0;
+  try {
+    const descriptor = Reflect.getOwnPropertyDescriptor(value, key);
+    return descriptor && "value" in descriptor ? descriptor.value : void 0;
+  } catch {
+    return void 0;
+  }
+}
 function validateAuthorizationBinding(input, parameterDigest, authorityMoment, currentTime = /* @__PURE__ */ new Date()) {
   const binding = input.authorizationBinding;
   if (binding.id !== input.authorizationBindingId && input.authorizationBindingId) throw new Error("Authorization binding ID does not match authorizationBindingId.");
@@ -1746,6 +2228,9 @@ function toEnterpriseEventEnvelope(event, metadata) {
     ...event.actionInvocationId ? { actionInvocationId: event.actionInvocationId } : {},
     correlationId: event.correlationId,
     ...event.causationId ? { causationId: event.causationId } : {},
+    // Opt-in only: without it the keys are absent, so existing publishers see an unchanged envelope.
+    ...includesActor(metadata) && event.actorId ? { actorId: event.actorId } : {},
+    ...includesActor(metadata) && event.actorType ? { actorType: event.actorType } : {},
     occurredAt: event.occurredAt,
     recordedAt: event.recordedAt,
     producerModuleVersion: metadata.producerModuleVersion,
@@ -1757,6 +2242,12 @@ function toEnterpriseEventEnvelope(event, metadata) {
     payload: event.payload
   };
 }
+function outboxActorDisclosure(metadata) {
+  return includesActor(metadata) ? "included" : "suppressed";
+}
+function includesActor(metadata) {
+  return metadata.includeActor === true;
+}
 async function runOutboxRelayCycle(options) {
   const now = options.now ?? (() => /* @__PURE__ */ new Date());
   const maxAttempts = options.maxAttempts ?? 10;
@@ -1791,7 +2282,7 @@ async function runOutboxRelayCycle(options) {
     try {
       await publishWithTimeout(
         options.publisher,
-        record.event,
+        record,
         options.publishTimeoutMs ?? 1e4
       );
       await stopHeartbeat();
@@ -1853,7 +2344,7 @@ async function runOutboxRelayCycle(options) {
   });
   return result;
 }
-async function publishWithTimeout(publisher, event, timeoutMs) {
+async function publishWithTimeout(publisher, record, timeoutMs) {
   if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
     throw new Error("publishTimeoutMs must be a positive finite number");
   }
@@ -1867,7 +2358,11 @@ async function publishWithTimeout(publisher, event, timeoutMs) {
     }, timeoutMs);
   });
   try {
-    await Promise.race([publisher.publish(event, { signal: controller.signal }), timeout]);
+    const context = {
+      signal: controller.signal,
+      actorDisclosure: record.actorDisclosure ?? "legacy"
+    };
+    await Promise.race([publisher.publish(record.event, context), timeout]);
   } finally {
     if (timer) clearTimeout(timer);
   }
@@ -1897,9 +2392,23 @@ function startOutboxHeartbeat(options, record, leaseDurationMs) {
   };
 }
 function cloneOutboxRecord(record) {
+  const event = {
+    ...record.event,
+    occurredAt: new Date(record.event.occurredAt),
+    recordedAt: new Date(record.event.recordedAt),
+    ...record.event.traceContext ? { traceContext: { ...record.event.traceContext } } : {}
+  };
+  if (record.actorDisclosure !== "included") {
+    delete event.actorId;
+    delete event.actorType;
+  }
   return {
     ...record,
-    event: { ...record.event, ...record.event.traceContext ? { traceContext: { ...record.event.traceContext } } : {} }
+    availableAt: new Date(record.availableAt),
+    createdAt: new Date(record.createdAt),
+    ...record.leaseExpiresAt ? { leaseExpiresAt: new Date(record.leaseExpiresAt) } : {},
+    ...record.publishedAt ? { publishedAt: new Date(record.publishedAt) } : {},
+    event
   };
 }
 function emitRelayTelemetry(telemetry, name, occurredAt, workerId, attributes) {
@@ -1931,6 +2440,13 @@ var MemoryPlatformHostStore = class {
   executionAttestations = [];
   externalReconciliations = [];
   outbox = [];
+  /**
+   * Requeue evidence is append-only audit history, so unlike the ledger
+   * arrays above, which tests have always inspected and seeded directly, it
+   * is not public: `listOutboxRequeues` returns copies with their own Dates. TypeScript
+   * `private`, as for the store's other internals, is a compile-time guard.
+   */
+  outboxRequeues = [];
   async transaction(run) {
     return run(this.db);
   }
@@ -2131,6 +2647,7 @@ var MemoryPlatformHostStore = class {
       tenantId: event.tenantId,
       spaceId: event.spaceId,
       event: toEnterpriseEventEnvelope(event, metadata),
+      actorDisclosure: outboxActorDisclosure(metadata),
       status: "pending",
       attemptCount: 0,
       availableAt: createdAt,
@@ -2172,6 +2689,42 @@ var MemoryPlatformHostStore = class {
   async listOutbox(input = {}) {
     return this.outbox.filter((record) => (!input.tenantId || record.tenantId === input.tenantId) && (!input.spaceId || record.spaceId === input.spaceId) && (!input.statuses?.length || input.statuses.includes(record.status))).map(cloneOutboxRecord);
   }
+  async getOutboxRecord(id, tenantId, spaceId) {
+    const record = this.outbox.find((candidate) => candidate.id === id && candidate.tenantId === tenantId && candidate.spaceId === spaceId);
+    return record ? cloneOutboxRecord(record) : void 0;
+  }
+  async requeueOutboxDeadLetter(input) {
+    const record = this.outbox.find((candidate) => candidate.id === input.id && candidate.tenantId === input.tenantId && candidate.spaceId === input.spaceId);
+    if (!record) return { applied: false, refusal: "not_found" };
+    if (record.status !== "dead_letter") return { applied: false, refusal: "not_dead_letter", currentStatus: record.status };
+    if ((record.leaseToken ?? 0) !== input.expectedLeaseToken) return { applied: false, refusal: "stale", currentStatus: record.status };
+    const requeue = {
+      id: input.requeueId,
+      outboxId: record.id,
+      tenantId: record.tenantId,
+      spaceId: record.spaceId,
+      eventId: record.event.eventId,
+      actorId: input.actorId,
+      actorType: input.actorType,
+      reason: input.reason,
+      requeuedAt: new Date(input.requeuedAt),
+      availableAt: new Date(input.availableAt),
+      priorAttemptCount: record.attemptCount,
+      ...record.lastError !== void 0 ? { priorLastError: record.lastError } : {},
+      priorAvailableAt: new Date(record.availableAt),
+      priorLeaseToken: record.leaseToken ?? 0
+    };
+    record.status = "pending";
+    record.attemptCount = 0;
+    record.availableAt = new Date(input.availableAt);
+    delete record.leaseOwner;
+    delete record.leaseExpiresAt;
+    this.outboxRequeues.push(requeue);
+    return { applied: true, record: cloneOutboxRecord(record), requeue: cloneOutboxRequeue(requeue) };
+  }
+  async listOutboxRequeues(input) {
+    return this.outboxRequeues.filter((requeue) => requeue.tenantId === input.tenantId && requeue.spaceId === input.spaceId && (input.outboxId === void 0 || requeue.outboxId === input.outboxId)).sort((left, right) => left.requeuedAt.getTime() - right.requeuedAt.getTime() || left.id.localeCompare(right.id)).map(cloneOutboxRequeue);
+  }
   requireLeasedOutbox(id, workerId, leaseToken) {
     const record = this.outbox.find((candidate) => candidate.id === id);
     if (!record || record.leaseOwner !== workerId || (record.leaseToken ?? 0) !== (leaseToken ?? 0)) {
@@ -2253,6 +2806,14 @@ var MemoryPlatformHostStore = class {
     return this.events.filter((event) => event.tenantId === tenantId && event.spaceId === spaceId).sort((left, right) => left.sequence - right.sequence);
   }
 };
+function cloneOutboxRequeue(requeue) {
+  return {
+    ...requeue,
+    requeuedAt: new Date(requeue.requeuedAt),
+    availableAt: new Date(requeue.availableAt),
+    priorAvailableAt: new Date(requeue.priorAvailableAt)
+  };
+}
 async function applyPostgresMigrations(client, migrations) {
   const ordered = validateMigrations(migrations);
   const statements = ordered.map((migration) => migrationStatement(migration));
@@ -2494,6 +3055,43 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 					ON fabric_platform.action_invocations (completion_due_at)
 					WHERE completion_due_at IS NOT NULL;
 			`
+    }, {
+      version: 4,
+      name: "outbox_actor_disclosure",
+      // Nullable with no default, so rows written before this migration stay NULL and read back
+      // as legacy. NOT VALID skips scanning existing rows; the check still applies to every
+      // insert and update from here on.
+      sql: `
+				ALTER TABLE fabric_platform.event_outbox
+					ADD COLUMN actor_disclosure text;
+				ALTER TABLE fabric_platform.event_outbox
+					ADD CONSTRAINT event_outbox_actor_disclosure_check
+					CHECK (actor_disclosure IN ('included', 'suppressed')) NOT VALID;
+			`
+    }, {
+      version: 5,
+      name: "outbox_requeue",
+      sql: `
+				CREATE TABLE fabric_platform.event_outbox_requeues (
+					id text PRIMARY KEY, outbox_id text NOT NULL,
+					tenant_id text NOT NULL, space_id text NOT NULL, event_id text NOT NULL,
+					actor_id text NOT NULL, actor_type text NOT NULL, reason text NOT NULL,
+					requeued_at timestamptz NOT NULL, available_at timestamptz NOT NULL,
+					prior_attempt_count integer NOT NULL, prior_last_error text,
+					prior_available_at timestamptz NOT NULL, prior_lease_token bigint NOT NULL
+				);
+				CREATE INDEX event_outbox_requeues_record_idx
+					ON fabric_platform.event_outbox_requeues (tenant_id, space_id, outbox_id, requeued_at);
+			`
+    }, {
+      version: 6,
+      name: "invocation_admission",
+      // Nullable with no default: rows written before this migration, and
+      // rows of actions that declare no admission check, stay NULL.
+      sql: `
+				ALTER TABLE fabric_platform.action_invocations
+					ADD COLUMN admitted_at timestamptz;
+			`
     }]);
   }
   async transaction(run) {
@@ -2501,44 +3099,59 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
   }
   async createActionInvocation(input) {
     const now = /* @__PURE__ */ new Date();
-    const result = await this.sql.query(
-      `INSERT INTO fabric_platform.action_invocations
-			 (id,tenant_id,space_id,action_id,action_version,actor_id,actor_type,status,
-				  parameters,result,correlation_id,causation_id,idempotency_key,
-				  parameter_digest,parameter_digest_algorithm,idempotency_actor_id,
-				  idempotency_authorization_binding_id,invocation_provenance,authorization_binding,execution_reason,
-				  authorization_binding_id,error,runtime_evidence,created_at,updated_at)
-				 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,$18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,$24,$24)
-			 ON CONFLICT (tenant_id,space_id,action_id,idempotency_key)
-			 WHERE idempotency_key IS NOT NULL DO UPDATE SET id=fabric_platform.action_invocations.id
-			 RETURNING *`,
-      [
-        input.id,
-        input.tenantId,
-        input.spaceId,
-        input.actionId,
-        input.actionVersion,
-        input.actorId,
-        input.actorType,
-        input.status,
-        JSON.stringify(input.parameters),
-        JSON.stringify(input.result),
-        input.correlationId,
-        input.causationId ?? null,
-        input.idempotencyKey ?? null,
-        input.parameterDigest ?? null,
-        input.parameterDigestAlgorithm ?? null,
-        input.idempotencyActorId ?? null,
-        input.idempotencyAuthorizationBindingId ?? null,
-        input.provenance ? JSON.stringify(input.provenance) : null,
-        input.authorizationBinding ? JSON.stringify(input.authorizationBinding) : null,
-        input.executionReason ?? null,
-        input.authorizationBindingId ?? null,
-        input.error ?? null,
-        input.runtimeEvidence ? JSON.stringify(input.runtimeEvidence) : null,
-        now
-      ]
-    );
+    const admitted = input.admittedAt !== void 0;
+    const admittedColumn = admitted ? "admitted_at," : "";
+    const admittedValue = admitted ? "$25," : "";
+    let result;
+    try {
+      result = await this.sql.query(
+        `INSERT INTO fabric_platform.action_invocations
+				 (id,tenant_id,space_id,action_id,action_version,actor_id,actor_type,status,
+					  parameters,result,correlation_id,causation_id,idempotency_key,
+					  parameter_digest,parameter_digest_algorithm,idempotency_actor_id,
+					  idempotency_authorization_binding_id,invocation_provenance,authorization_binding,execution_reason,
+					  authorization_binding_id,error,runtime_evidence,${admittedColumn}created_at,updated_at)
+					 VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9::jsonb,$10::jsonb,$11,$12,$13,$14,$15,$16,$17,$18::jsonb,$19::jsonb,$20,$21,$22,$23::jsonb,${admittedValue}$24,$24)
+				 ON CONFLICT (tenant_id,space_id,action_id,idempotency_key)
+				 WHERE idempotency_key IS NOT NULL DO UPDATE SET id=fabric_platform.action_invocations.id
+				 RETURNING *`,
+        [
+          input.id,
+          input.tenantId,
+          input.spaceId,
+          input.actionId,
+          input.actionVersion,
+          input.actorId,
+          input.actorType,
+          input.status,
+          JSON.stringify(input.parameters),
+          JSON.stringify(input.result),
+          input.correlationId,
+          input.causationId ?? null,
+          input.idempotencyKey ?? null,
+          input.parameterDigest ?? null,
+          input.parameterDigestAlgorithm ?? null,
+          input.idempotencyActorId ?? null,
+          input.idempotencyAuthorizationBindingId ?? null,
+          input.provenance ? JSON.stringify(input.provenance) : null,
+          input.authorizationBinding ? JSON.stringify(input.authorizationBinding) : null,
+          input.executionReason ?? null,
+          input.authorizationBindingId ?? null,
+          input.error ?? null,
+          input.runtimeEvidence ? JSON.stringify(input.runtimeEvidence) : null,
+          now,
+          ...admitted ? [input.admittedAt] : []
+        ]
+      );
+    } catch (error) {
+      if (admitted && error?.code === "42703") {
+        throw new Error(
+          "An admitted invocation needs the action_invocations.admitted_at column; run ensureSchema() to apply PostgreSQL migration 6 (invocation_admission) before submitting actions that declare admitSubmission.",
+          { cause: error }
+        );
+      }
+      throw error;
+    }
     return toActionRecord(result.rows[0]);
   }
   async getActionInvocation(id, tenantId, spaceId) {
@@ -2813,8 +3426,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
 				 ON CONFLICT (id) DO NOTHING RETURNING id
 			)
 			INSERT INTO fabric_platform.event_outbox
-			 (id,tenant_id,space_id,event,status,attempt_count,available_at,created_at)
-			SELECT $1,$2,$3,$18::jsonb,'pending',0,$14,$14 FROM inserted_event
+			 (id,tenant_id,space_id,event,actor_disclosure,status,attempt_count,available_at,created_at)
+			SELECT $1,$2,$3,$18::jsonb,$20,'pending',0,$14,$14 FROM inserted_event
 			ON CONFLICT (id) DO NOTHING`,
       [
         event.id,
@@ -2835,7 +3448,8 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
         event.causationId ?? null,
         event.provenance ? JSON.stringify(event.provenance) : null,
         JSON.stringify(envelope),
-        event.consistency ?? null
+        event.consistency ?? null,
+        outboxActorDisclosure(metadata)
       ]
     );
   }
@@ -2903,6 +3517,90 @@ var PostgresPlatformHostStore = class _PostgresPlatformHostStore {
     );
     return result.rows.map(toOutboxRecord);
   }
+  async getOutboxRecord(id, tenantId, spaceId) {
+    const result = await this.sql.query(
+      `SELECT * FROM fabric_platform.event_outbox
+			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3`,
+      [id, tenantId, spaceId]
+    );
+    return result.rows[0] ? toOutboxRecord(result.rows[0]) : void 0;
+  }
+  async requeueOutboxDeadLetter(input) {
+    const result = await this.sql.query(
+      `WITH prior AS (
+				SELECT id, tenant_id, space_id, event->>'eventId' AS event_id,
+				       attempt_count, last_error, available_at, lease_token
+				FROM fabric_platform.event_outbox
+				WHERE id=$1 AND tenant_id=$2 AND space_id=$3 AND status='dead_letter'
+				  AND lease_token=$10
+				FOR UPDATE
+			), requeued AS (
+				UPDATE fabric_platform.event_outbox AS item
+				SET status='pending', attempt_count=0, available_at=$9,
+				    lease_owner=NULL, lease_expires_at=NULL
+				FROM prior WHERE item.id=prior.id
+				RETURNING item.*
+			), evidence AS (
+				INSERT INTO fabric_platform.event_outbox_requeues
+				 (id,outbox_id,tenant_id,space_id,event_id,actor_id,actor_type,reason,
+				  requeued_at,available_at,prior_attempt_count,prior_last_error,
+				  prior_available_at,prior_lease_token)
+				SELECT $4,prior.id,prior.tenant_id,prior.space_id,prior.event_id,$5,$6,$7,
+				       $8,$9,prior.attempt_count,prior.last_error,prior.available_at,prior.lease_token
+				FROM prior JOIN requeued ON requeued.id=prior.id
+				RETURNING *
+			)
+			SELECT requeued.*,
+			       evidence.id AS requeue_id, evidence.outbox_id AS requeue_outbox_id,
+			       evidence.tenant_id AS requeue_tenant_id, evidence.space_id AS requeue_space_id,
+			       evidence.event_id AS requeue_event_id, evidence.actor_id AS requeue_actor_id,
+			       evidence.actor_type AS requeue_actor_type, evidence.reason AS requeue_reason,
+			       evidence.requeued_at AS requeue_requeued_at, evidence.available_at AS requeue_available_at,
+			       evidence.prior_attempt_count AS requeue_prior_attempt_count,
+			       evidence.prior_last_error AS requeue_prior_last_error,
+			       evidence.prior_available_at AS requeue_prior_available_at,
+			       evidence.prior_lease_token AS requeue_prior_lease_token
+			FROM requeued JOIN evidence ON evidence.outbox_id=requeued.id`,
+      [
+        input.id,
+        input.tenantId,
+        input.spaceId,
+        input.requeueId,
+        input.actorId,
+        input.actorType,
+        input.reason,
+        input.requeuedAt,
+        input.availableAt,
+        input.expectedLeaseToken
+      ]
+    );
+    const row = result.rows[0];
+    if (row) {
+      return {
+        applied: true,
+        record: toOutboxRecord(row),
+        requeue: toOutboxRequeueRecord(row, "requeue_")
+      };
+    }
+    const current = await this.sql.query(
+      `SELECT status FROM fabric_platform.event_outbox
+			 WHERE id=$1 AND tenant_id=$2 AND space_id=$3`,
+      [input.id, input.tenantId, input.spaceId]
+    );
+    const found = current.rows[0];
+    if (!found) return { applied: false, refusal: "not_found" };
+    const status = found.status;
+    return status === "dead_letter" ? { applied: false, refusal: "stale", currentStatus: status } : { applied: false, refusal: "not_dead_letter", currentStatus: status };
+  }
+  async listOutboxRequeues(input) {
+    const result = await this.sql.query(
+      `SELECT * FROM fabric_platform.event_outbox_requeues
+			 WHERE tenant_id=$1 AND space_id=$2 AND ($3::text IS NULL OR outbox_id=$3)
+			 ORDER BY requeued_at,id`,
+      [input.tenantId, input.spaceId, input.outboxId ?? null]
+    );
+    return result.rows.map((row) => toOutboxRequeueRecord(row, ""));
+  }
   async nextEventSequence(tenantId, spaceId) {
     const result = await this.sql.query(
       `INSERT INTO fabric_platform.event_sequences (tenant_id,space_id,next_sequence)
@@ -3175,6 +3873,7 @@ function toActionRecord(row) {
     ...row.mutation_footprint ? { mutationFootprint: row.mutation_footprint } : {},
     ...row.execution_principal ? { executionPrincipal: row.execution_principal } : {},
     ...row.runtime_evidence ? { runtimeEvidence: row.runtime_evidence } : {},
+    ...row.admitted_at ? { admittedAt: new Date(row.admitted_at) } : {},
     ...row.error ? { error: String(row.error) } : {},
     createdAt: new Date(row.created_at),
     updatedAt: new Date(row.updated_at)
@@ -3243,10 +3942,13 @@ function toEventRecord(row) {
 }
 function toOutboxRecord(row) {
   const event = row.event;
+  const actorDisclosure = row.actor_disclosure === "included" || row.actor_disclosure === "suppressed" ? row.actor_disclosure : void 0;
+  const actorIncluded = actorDisclosure === "included";
   return {
     id: String(row.id),
     tenantId: String(row.tenant_id),
     spaceId: String(row.space_id),
+    ...actorDisclosure ? { actorDisclosure } : {},
     event: {
       eventId: String(event.eventId),
       eventType: String(event.eventType),
@@ -3259,6 +3961,8 @@ function toOutboxRecord(row) {
       ...event.actionInvocationId ? { actionInvocationId: String(event.actionInvocationId) } : {},
       correlationId: String(event.correlationId),
       ...event.causationId ? { causationId: String(event.causationId) } : {},
+      ...actorIncluded && event.actorId ? { actorId: String(event.actorId) } : {},
+      ...actorIncluded && event.actorType ? { actorType: String(event.actorType) } : {},
       ...event.provenance ? { provenance: event.provenance } : {},
       ...event.consistency ? { consistency: event.consistency } : {},
       occurredAt: new Date(event.occurredAt),
@@ -3279,6 +3983,26 @@ function toOutboxRecord(row) {
     ...row.published_at ? { publishedAt: new Date(row.published_at) } : {}
   };
 }
+function toOutboxRequeueRecord(row, prefix) {
+  const field = (name) => row[`${prefix}${name}`];
+  const priorLastError = field("prior_last_error");
+  return {
+    id: String(field("id")),
+    outboxId: String(field("outbox_id")),
+    tenantId: String(field("tenant_id")),
+    spaceId: String(field("space_id")),
+    eventId: String(field("event_id")),
+    actorId: String(field("actor_id")),
+    actorType: String(field("actor_type")),
+    reason: String(field("reason")),
+    requeuedAt: new Date(field("requeued_at")),
+    availableAt: new Date(field("available_at")),
+    priorAttemptCount: Number(field("prior_attempt_count")),
+    ...priorLastError !== null && priorLastError !== void 0 ? { priorLastError: String(priorLastError) } : {},
+    priorAvailableAt: new Date(field("prior_available_at")),
+    priorLeaseToken: Number(field("prior_lease_token"))
+  };
+}
 
 // src/worker.ts
 var DEFAULT_BATCH_SIZE = 10;
@@ -3739,6 +4463,11 @@ async function runTenantIsolationChecks(subject) {
   return { passed: checks.every((check) => check.status !== "failed"), checks };
 }
 
+Object.defineProperty(exports, "canonicalJson", {
+  enumerable: true,
+  get: function () { return platform.canonicalJson; }
+});
+exports.ActionAdmissionError = ActionAdmissionError;
 exports.ExternalCompletionError = ExternalCompletionError;
 exports.IdempotencyConflictError = IdempotencyConflictError;
 exports.MemoryPlatformHostStore = MemoryPlatformHostStore;
@@ -3748,7 +4477,6 @@ exports.PLATFORM_HOST_HEALTH_CONTRACT_VERSION = PLATFORM_HOST_HEALTH_CONTRACT_VE
 exports.PLATFORM_HOST_METRIC_NAMES = PLATFORM_HOST_METRIC_NAMES;
 exports.PostgresPlatformHostStore = PostgresPlatformHostStore;
 exports.applyPostgresMigrations = applyPostgresMigrations;
-exports.canonicalJson = canonicalJson;
 exports.cloneOutboxRecord = cloneOutboxRecord;
 exports.createDurableSagaParentLifecycle = createDurableSagaParentLifecycle;
 exports.createGovernedActionHost = createGovernedActionHost;
@@ -3756,6 +4484,7 @@ exports.createStoreBackedActionDispatcher = createStoreBackedActionDispatcher;
 exports.digestParameters = digestParameters;
 exports.emitPlatformHostTelemetry = emitPlatformHostTelemetry;
 exports.getPlatformHostHealthSnapshot = getPlatformHostHealthSnapshot;
+exports.outboxActorDisclosure = outboxActorDisclosure;
 exports.runOutboxRelayCycle = runOutboxRelayCycle;
 exports.runPlatformActionWorker = runPlatformActionWorker;
 exports.runPlatformActionWorkerCycle = runPlatformActionWorkerCycle;