@fabricorg/platform-host 7.2.3 → 7.4.0

package/dist/index.d.ts

@@ -1,4 +1,5 @@
-import { ActorType, ActionId, ActionStatus, EvidencePacketReference, AgentActionRoute, AgentActionRiskTier, MutationFootprint, ExecutionPrincipal, GovernanceRuntimeEvidence, PolicyOutcome, AssetEventEnvelope, ExecutionAttestation, ExternalReconciliation, PolicyObligation, PolicyObligationStatus, ModuleRegistry, ActionDefinition, AdapterImplementation, FabricRuntimeServices, AgentActionPolicyEvaluator, MutationGovernanceResolver, RuntimePolicyDefinition } from '@fabricorg/platform';
+import { ActorType, ActionId, ActionStatus, EvidencePacketReference, AgentActionRoute, AgentActionRiskTier, MutationFootprint, ExecutionPrincipal, GovernanceRuntimeEvidence, PolicyOutcome, AssetEventEnvelope, ExecutionAttestation, ExternalReconciliation, PolicyObligation, PolicyObligationStatus, ModuleRegistry, ActionDefinition, AdapterImplementation, AdapterCircuitBreakerProvider, FabricRuntimeServices, AgentActionPolicyEvaluator, MutationGovernanceResolver, RuntimePolicyDefinition } from '@fabricorg/platform';
+export { canonicalJson } from '@fabricorg/platform';
 import { AssemblyLockfile } from '@fabricorg/assembly';
 
 /** Version of the vendor-neutral health/readiness contract. */
@@ -12,6 +13,7 @@ declare const PLATFORM_HOST_METRIC_NAMES: {
     readonly workerCyclesCompleted: "fabric.platform.worker.cycles.completed";
     readonly workerCyclesFailed: "fabric.platform.worker.cycles.failed";
     readonly invocationSubmitted: "fabric.platform.invocation.submitted";
+    readonly invocationAdmissionRefused: "fabric.platform.invocation.admission_refused";
     readonly invocationExecutionStarted: "fabric.platform.invocation.execution_started";
     readonly invocationLeaseClaimed: "fabric.platform.invocation.lease_claimed";
     readonly invocationCompleted: "fabric.platform.invocation.completed";
@@ -27,6 +29,8 @@ declare const PLATFORM_HOST_METRIC_NAMES: {
     readonly outboxPublished: "fabric.platform.outbox.published";
     readonly outboxFailed: "fabric.platform.outbox.failed";
     readonly outboxDeadLettered: "fabric.platform.outbox.dead_lettered";
+    readonly outboxRequeued: "fabric.platform.outbox.requeued";
+    readonly outboxRequeueRefused: "fabric.platform.outbox.requeue_refused";
     readonly invocationBacklog: "fabric.platform.invocation.backlog";
     readonly invocationRunning: "fabric.platform.invocation.running";
     readonly invocationExpiredLeases: "fabric.platform.invocation.expired_leases";
@@ -37,7 +41,7 @@ declare const PLATFORM_HOST_METRIC_NAMES: {
     readonly outboxDeadLetters: "fabric.platform.outbox.dead_letters";
 };
 type PlatformHostMetricName = (typeof PLATFORM_HOST_METRIC_NAMES)[keyof typeof PLATFORM_HOST_METRIC_NAMES];
-type PlatformHostTelemetryEventName = "worker.cycle.started" | "worker.cycle.completed" | "worker.cycle.failed" | "invocation.submitted" | "invocation.execution_started" | "invocation.lease_claimed" | "invocation.completed" | "invocation.failed" | "invocation.policy_blocked" | "invocation.validation_failed" | "invocation.approval_waited" | "invocation.reconciliation_required" | "outbox.relay.started" | "outbox.relay.completed" | "outbox.relay.failed" | "outbox.lease_claimed" | "outbox.published" | "outbox.failed" | "outbox.dead_lettered";
+type PlatformHostTelemetryEventName = "worker.cycle.started" | "worker.cycle.completed" | "worker.cycle.failed" | "invocation.submitted" | "invocation.admission_refused" | "invocation.execution_started" | "invocation.lease_claimed" | "invocation.completed" | "invocation.failed" | "invocation.policy_blocked" | "invocation.validation_failed" | "invocation.approval_waited" | "invocation.reconciliation_required" | "outbox.relay.started" | "outbox.relay.completed" | "outbox.relay.failed" | "outbox.lease_claimed" | "outbox.published" | "outbox.failed" | "outbox.dead_lettered" | "outbox.requeued" | "outbox.requeue_refused";
 type PlatformHostMetricType = "counter" | "gauge";
 type PlatformHostTelemetryAttribute = string | number | boolean;
 interface PlatformHostLifecycleTelemetry {
@@ -185,6 +189,34 @@ declare class IdempotencyConflictError extends Error {
     readonly code: "IDEMPOTENCY_CONFLICT";
     constructor(conflict: IdempotencyConflict);
 }
+/**
+ * Why `submitAction` did not admit a submission of an action that declares
+ * `admitSubmission`: `refused`, the check answered `{ admitted: false, code }`
+ * with a well-formed code; `failed`, it threw or is not a function;
+ * `timed_out`, its answer did not settle within `admissionTimeoutMs`;
+ * `invalid_decision`, it answered anything other than `{ admitted: true }`
+ * or a well-formed refusal; `invalid_parameters`, the parameters are not a
+ * JSON-data object Host could copy at submission (a Proxy, a function, a
+ * Date, a typed array or SharedArrayBuffer, a cycle, a getter that throws).
+ */
+type ActionAdmissionRefusal = "refused" | "failed" | "timed_out" | "invalid_decision" | "invalid_parameters";
+/**
+ * Thrown by `submitAction` when a declared admission check did not admit the
+ * submission. Host wrote nothing for it: no invocation, idempotency key,
+ * event, policy record or error. The message holds the action id, the
+ * refusal and, for `refused`, the check's code; never a submitted value or
+ * anything the check threw.
+ */
+declare class ActionAdmissionError extends Error {
+    readonly actionId: string;
+    readonly refusal: ActionAdmissionRefusal;
+    /** The check's own code, present only for `refused`. */
+    readonly refusalCode?: string | undefined;
+    readonly code: "ACTION_ADMISSION_REFUSED";
+    constructor(actionId: string, refusal: ActionAdmissionRefusal, 
+    /** The check's own code, present only for `refused`. */
+    refusalCode?: string | undefined);
+}
 type ExternalCompletionRefusal = "still_executing" | "not_found" | "not_awaiting" | "immediate_contract" | "reference_mismatch" | "provider_mismatch" | "invalid_completion" | "result_invalid";
 /**
  * Why a completion was not applied, typed so a webhook handler can answer
@@ -253,6 +285,13 @@ interface ActionInvocationRecord {
     mutationFootprint?: MutationFootprint;
     executionPrincipal?: ExecutionPrincipal;
     runtimeEvidence?: GovernanceRuntimeEvidence;
+    /**
+     * When `submitAction` admitted the submission through the action's
+     * `admitSubmission` check, set on creation and never patched. Host refuses
+     * to execute an invocation of an action that declares the check when this
+     * is absent, and passes it to the handler as `ActionContext.admittedAt`.
+     */
+    admittedAt?: Date;
     error?: string;
     createdAt: Date;
     updatedAt: Date;
@@ -447,7 +486,24 @@ interface OutboxEventMetadata {
     payloadClassification: EventPayloadClassification;
     traceContext?: Record<string, string>;
     includeProvenance?: boolean;
+    /**
+     * Only `true` puts the event's `actorId` and `actorType` on the outbox envelope. Absent or any
+     * other value leaves them off, and the outbox record says the actor was `suppressed`.
+     */
+    includeActor?: boolean;
 }
+/**
+ * Whether Host put actor identity on an outbox record's envelope, decided by `includeActor` when
+ * the record was written. A record has no value when it predates the decision (`legacy`).
+ */
+type OutboxActorDisclosure = "included" | "suppressed";
+/**
+ * What the relay tells a publisher about an envelope's actor identity: the record's
+ * `OutboxActorDisclosure`, or `legacy` for a record with none. The memory and PostgreSQL stores
+ * hydrate actor identity only for `included` records, so their legacy and suppressed envelopes carry
+ * none; a consumer that needs it reads the canonical event.
+ */
+type EnterpriseEventActorDisclosure = OutboxActorDisclosure | "legacy";
 interface EnterpriseEventEnvelope {
     eventId: string;
     eventType: string;
@@ -460,6 +516,10 @@ interface EnterpriseEventEnvelope {
     actionInvocationId?: string;
     correlationId: string;
     causationId?: string;
+    /** Present only when `includeActor` opted this event in; the key is absent otherwise. */
+    actorId?: string;
+    /** Present only when `includeActor` opted this event in; the key is absent otherwise. */
+    actorType?: string;
     occurredAt: Date;
     recordedAt: Date;
     producerModuleVersion: string;
@@ -478,6 +538,8 @@ interface OutboxRecord {
     tenantId: string;
     spaceId: string;
     event: EnterpriseEventEnvelope;
+    /** Absent for a record written before Host recorded the `includeActor` decision. */
+    actorDisclosure?: OutboxActorDisclosure;
     status: OutboxStatus;
     attemptCount: number;
     availableAt: Date;
@@ -523,6 +585,125 @@ interface OutboxPlatformHostStore<TDb> extends PlatformHostStore<TDb> {
         statuses?: OutboxStatus[];
     }): Promise<OutboxRecord[]>;
 }
+/**
+ * Append-only evidence of one operator requeue of a dead-lettered outbox
+ * record. The `prior*` fields are the dead-letter state the requeue replaced,
+ * so the failure that exhausted the record stays readable after its attempt
+ * budget is reset.
+ */
+interface OutboxRequeueRecord {
+    id: string;
+    outboxId: string;
+    tenantId: string;
+    spaceId: string;
+    eventId: string;
+    actorId: string;
+    actorType: ActorType;
+    /** Operator-supplied justification, persisted as audit evidence. Must not carry secrets. */
+    reason: string;
+    requeuedAt: Date;
+    /** When the requeued record became claimable again. */
+    availableAt: Date;
+    priorAttemptCount: number;
+    priorLastError?: string;
+    priorAvailableAt: Date;
+    priorLeaseToken: number;
+}
+interface RequeueOutboxDeadLetterStoreInput {
+    id: string;
+    tenantId: string;
+    spaceId: string;
+    /** Identity of the evidence row written with the transition. */
+    requeueId: string;
+    actorId: string;
+    actorType: ActorType;
+    reason: string;
+    requeuedAt: Date;
+    availableAt: Date;
+    /**
+     * The lease token of the dead letter the caller read and authorized. Every
+     * claim increments the token and a requeue never lowers it, so a record
+     * that was requeued, claimed and dead-lettered again carries a higher token
+     * than the one observed, and the requeue is refused as `stale`.
+     */
+    expectedLeaseToken: number;
+}
+/**
+ * `not_found`: no record with this id in the tenant and space, including a
+ * record that exists under another tenant or space. `not_dead_letter`: the
+ * record exists but is pending or published, for example because another
+ * requeue won the compare-and-set. `stale`: the record is a dead letter
+ * again, but not the one the caller observed; read and authorize it afresh.
+ */
+type OutboxRequeueRefusal = "not_found" | "not_dead_letter" | "stale";
+type RequeueOutboxDeadLetterStoreResult = {
+    applied: true;
+    record: OutboxRecord;
+    requeue: OutboxRequeueRecord;
+} | {
+    applied: false;
+    refusal: OutboxRequeueRefusal;
+    currentStatus?: OutboxStatus;
+};
+/**
+ * Optional outbox capability that moves a dead-lettered record back to
+ * pending. Kept apart from `OutboxPlatformHostStore` so a custom outbox store
+ * that predates it still satisfies that interface.
+ */
+interface OutboxRequeuePlatformHostStore<TDb> extends OutboxPlatformHostStore<TDb> {
+    getOutboxRecord(id: string, tenantId: string, spaceId: string): Promise<OutboxRecord | undefined>;
+    /**
+     * Compare-and-set from `dead_letter` at `expectedLeaseToken` to `pending`
+     * within the tenant and space: resets `attemptCount` to 0, sets
+     * `availableAt`, clears any lease owner while keeping the lease token,
+     * keeps `lastError`, and appends one `OutboxRequeueRecord` in the same
+     * atomic step. A record in any other state, at another lease token, or in
+     * another scope is refused and nothing is written. The returned requeue
+     * evidence shares nothing with stored history. The returned outbox record
+     * has its own Date fields; its event payload and provenance are shallow.
+     */
+    requeueOutboxDeadLetter(input: RequeueOutboxDeadLetterStoreInput): Promise<RequeueOutboxDeadLetterStoreResult>;
+    /** Requeue evidence for a scope, oldest first; `outboxId` narrows it to one record. */
+    listOutboxRequeues(input: {
+        tenantId: string;
+        spaceId: string;
+        outboxId?: string;
+    }): Promise<OutboxRequeueRecord[]>;
+}
+interface RequeueOutboxDeadLetterInput {
+    outboxId: string;
+    tenantId: string;
+    spaceId: string;
+    /** Trusted operator identity from the caller's authenticated session, never from request input. */
+    actorId: string;
+    actorType: ActorType;
+    /** Required justification, at most 1,000 characters, persisted as audit evidence. */
+    reason: string;
+    /** When the record becomes claimable again; defaults to the host clock. */
+    availableAt?: Date;
+}
+type RequeueOutboxDeadLetterRefusal = OutboxRequeueRefusal | "not_authorized";
+type RequeueOutboxDeadLetterResult = {
+    status: "requeued";
+    record: OutboxRecord;
+    requeue: OutboxRequeueRecord;
+} | {
+    status: "refused";
+    refusal: RequeueOutboxDeadLetterRefusal;
+    /** Present for `not_dead_letter` and `stale`: the state the record was found in. */
+    currentStatus?: OutboxStatus;
+    message: string;
+};
+/** Facts given to `authorizeOutboxRequeue`. `record` is absent when no record with this id exists in the scope. */
+interface OutboxRequeueAuthorizationInput {
+    tenantId: string;
+    spaceId: string;
+    actorId: string;
+    actorType: ActorType;
+    outboxId: string;
+    reason: string;
+    record?: Pick<OutboxRecord["event"], "eventId" | "eventType" | "payloadClassification"> & Pick<OutboxRecord, "status" | "attemptCount">;
+}
 /**
  * Optional production capability for atomic domain/event persistence.
  *
@@ -648,6 +829,16 @@ interface ActionExecutionAuthorizationInput extends ActionAuthorizationInput {
     invocation: Readonly<ActionInvocationRecord>;
     executionReason: ActionExecutionReason;
 }
+/**
+ * Input to `resolvePolicies`. Carries the invocation identity and the
+ * schema-parsed durable (post-redaction) parameters so a resolver can choose
+ * the policy snapshot pinned to this specific invocation. Host keeps the first
+ * persisted evaluation per invocation and policy, so return the same snapshot
+ * for an `actionInvocationId` on every attempt.
+ */
+interface ResolvePoliciesInput extends ActionExecutionAuthorizationInput {
+    declaredPolicyIds: readonly string[];
+}
 interface PlatformHostAuthorization {
     checkEntitlement(input: ActionAuthorizationInput): Promise<boolean>;
     authorize(input: ActionAuthorizationInput): Promise<boolean>;
@@ -660,6 +851,12 @@ interface PlatformHostAuthorization {
     authorizeApproval?(input: ActionAuthorizationInput & {
         decision: ActionApprovalDecision;
     }): Promise<boolean>;
+    /**
+     * Authorization for `requeueOutboxDeadLetter`. There is no action to fall
+     * back to, so when this is absent every requeue is refused as
+     * `not_authorized`. A throw propagates and nothing is requeued.
+     */
+    authorizeOutboxRequeue?(input: OutboxRequeueAuthorizationInput): Promise<boolean>;
 }
 interface DispatchActionInput {
     actionInvocationId: string;
@@ -675,6 +872,18 @@ interface DispatchActionResult {
 interface PlatformActionDispatcher {
     dispatch(input: DispatchActionInput): Promise<DispatchActionResult>;
 }
+/**
+ * One submission. `submitAction` reads the scalar fields (`actionId`, scope,
+ * actor, correlation and causation ids, `executionReason`, `idempotencyKey`,
+ * `authorizationBindingId`) exactly once, before its first await, and uses
+ * only those values afterwards, so changing them while the call is pending
+ * changes no action, scope, actor or key Host authorizes, persists or
+ * executes. For an action that declares `admitSubmission`, `parameters`,
+ * `provenance` and `authorizationBinding` are also read once there and
+ * replaced by Host's own copies. For any other action Host uses those three
+ * as the caller's objects, read where and as often as before (README,
+ * "Submission snapshot").
+ */
 interface SubmitActionInput {
     actionId: ActionId;
     parameters: Record<string, unknown>;
@@ -763,6 +972,15 @@ interface PlatformHostOptions<TDb> {
     /** Resolve vertical- or runtime-local actions without mutating the process-wide registry. */
     resolveAction?: (actionId: ActionId) => ActionDefinition<TDb> | undefined;
     adapters?: readonly AdapterImplementation[];
+    /**
+     * Supplies the circuit breaker for each adapter call. Defaults to a new
+     * `AdapterCircuitBreakerRegistry` per Host instance, which creates one
+     * in-process breaker per `adapterType:operation` from that adapter's own
+     * `circuitBreaker` config, on first use, and none for adapters without one.
+     * Pass a shared registry or a custom provider to share breakers between
+     * Host instances, receive breaker telemetry, or set manual overrides.
+     */
+    adapterCircuitBreakers?: AdapterCircuitBreakerProvider;
     dispatcher?: PlatformActionDispatcher;
     services?: FabricRuntimeServices;
     idempotency?: {
@@ -782,6 +1000,12 @@ interface PlatformHostOptions<TDb> {
         producerModuleVersion(actionId: ActionId, actionVersion: number): string;
         classifyPayload(event: AssetEventEnvelope): EventPayloadClassification;
         includeProvenance?(event: AssetEventEnvelope, classification: EventPayloadClassification): boolean;
+        /**
+         * Opt an event's `actorId` and `actorType` into its outbox envelope. Absent, the actor is
+         * excluded for every classification. Only `true` includes it. An included actor reaches every
+         * sink of every relay reading this outbox.
+         */
+        includeActor?(event: AssetEventEnvelope, classification: EventPayloadClassification): boolean;
         traceContext?(event: AssetEventEnvelope): Record<string, string> | undefined;
         /** Host lifecycle events are excluded by default; opt in only after making their payload audit-safe. */
         shouldPublish?(event: AssetEventEnvelope): boolean;
@@ -816,15 +1040,38 @@ interface PlatformHostOptions<TDb> {
      */
     composition?: {
         assembly: AssemblyLockfile;
+        /**
+         * Receives a fresh object whose action, scope, actor, correlation,
+         * causation, idempotency key, binding id and execution reason are the
+         * ones Host read at submission and persists, whatever the caller
+         * changed on its own object since. For an action without
+         * `admitSubmission`, its `parameters`, `provenance` and
+         * `authorizationBinding` read and assign the caller's input, as when
+         * the callback was handed that input itself; for an action that
+         * declares it, they are fresh copies of Host's snapshot.
+         */
         resolveInitiatingReleaseDigest?(input: SubmitActionInput): Promise<string | undefined> | string | undefined;
     };
     /** Lease held while an approved invocation resumes; defaults to five minutes. */
     approvalResumeLeaseDurationMs?: number;
-    /** Remove forbidden/sensitive fields before durable invocation persistence. */
+    /**
+     * Remove forbidden/sensitive fields before durable invocation persistence.
+     * For an action without `admitSubmission`, receives the caller's
+     * parameters object, before provenance normalization and the composition
+     * callback, as before. For an action that declares it, receives Host's
+     * copy, after the check admitted the submission.
+     */
     redactActionParameters?: (actionId: ActionId, parameters: Record<string, unknown>) => Record<string, unknown>;
-    resolvePolicies?: (input: ActionAuthorizationInput & {
-        declaredPolicyIds: readonly string[];
-    }) => Promise<RuntimePolicyDefinition[]>;
+    /**
+     * The bound on an action's `admitSubmission` check. An answer that
+     * settles this many milliseconds or more after the check was called,
+     * measured on the monotonic clock when its promise settles, is refused as
+     * `timed_out` and the check's signal is aborted. A whole number from 1 to
+     * 2 147 483 647 (the timer maximum), or `createGovernedActionHost` throws;
+     * default 10 000.
+     */
+    admissionTimeoutMs?: number;
+    resolvePolicies?: (input: ResolvePoliciesInput) => Promise<RuntimePolicyDefinition[]>;
     extractEvents?: (data: Record<string, unknown>) => PendingAssetEvent[];
     /** Handler-result fields consumed by extractEvents and omitted from the durable result. */
     eventResultFields?: readonly string[];
@@ -863,14 +1110,30 @@ interface GovernedActionHost {
         overdue: string[];
     }>;
 }
+/**
+ * Host operator operations kept outside `GovernedActionHost`, so an existing
+ * hand-written `GovernedActionHost` still satisfies that interface.
+ * `createGovernedActionHost()` returns both.
+ */
+interface OutboxRequeueHost {
+    /**
+     * Operator replay of a dead-lettered outbox record: authorize the trusted
+     * actor for the tenant and space against the record as read, then move
+     * that same dead letter back to pending with a fresh attempt budget and
+     * append who, when, and why beside the earlier failure. The relay
+     * republishes it under the same `eventId`. Requires an
+     * `OutboxRequeuePlatformHostStore`; refusals are returned, not thrown.
+     */
+    requeueOutboxDeadLetter(input: RequeueOutboxDeadLetterInput): Promise<RequeueOutboxDeadLetterResult>;
+}
 
-declare function createGovernedActionHost<TDb>(options: PlatformHostOptions<TDb>): GovernedActionHost;
+declare function createGovernedActionHost<TDb>(options: PlatformHostOptions<TDb>): GovernedActionHost & OutboxRequeueHost;
 
 interface MemoryPlatformHostTransactionProvider<TDb> {
     snapshot(db: TDb): TDb;
     restore(db: TDb, snapshot: TDb): void;
 }
-declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb> {
+declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb>, OutboxRequeuePlatformHostStore<TDb> {
     readonly db: TDb;
     readonly transactionalOutbox: boolean;
     transactionWithEvents?: <TResult>(run: (transaction: PlatformHostMutationTransaction<TDb>) => Promise<TResult>) => Promise<TResult>;
@@ -883,6 +1146,13 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     readonly executionAttestations: ExecutionAttestationRecord[];
     readonly externalReconciliations: ExternalReconciliationRecord[];
     readonly outbox: OutboxRecord[];
+    /**
+     * Requeue evidence is append-only audit history, so unlike the ledger
+     * arrays above, which tests have always inspected and seeded directly, it
+     * is not public: `listOutboxRequeues` returns copies with their own Dates. TypeScript
+     * `private`, as for the store's other internals, is a compile-time guard.
+     */
+    private readonly outboxRequeues;
     constructor(db: TDb, transactionProvider?: MemoryPlatformHostTransactionProvider<TDb>);
     transaction<TResult>(run: (db: TDb) => Promise<TResult>): Promise<TResult>;
     private runTransactionWithEvents;
@@ -929,6 +1199,13 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
         spaceId?: string;
         statuses?: OutboxStatus[];
     }): Promise<OutboxRecord[]>;
+    getOutboxRecord(id: string, tenantId: string, spaceId: string): Promise<OutboxRecord | undefined>;
+    requeueOutboxDeadLetter(input: RequeueOutboxDeadLetterStoreInput): Promise<RequeueOutboxDeadLetterStoreResult>;
+    listOutboxRequeues(input: {
+        tenantId: string;
+        spaceId: string;
+        outboxId?: string;
+    }): Promise<OutboxRequeueRecord[]>;
     private requireLeasedOutbox;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
@@ -941,10 +1218,18 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
 }
 
 declare function toEnterpriseEventEnvelope(event: AssetEventEnvelope, metadata: OutboxEventMetadata): EnterpriseEventEnvelope;
+/** The `includeActor` decision a store records with the outbox record it writes from `metadata`. */
+declare function outboxActorDisclosure(metadata: OutboxEventMetadata): OutboxActorDisclosure;
+interface EnterpriseEventPublishContext {
+    signal: AbortSignal;
+    /**
+     * Why the envelope does or does not carry `actorId`/`actorType`. `runOutboxRelayCycle()` always
+     * sets it; a caller other than the relay may omit it, which a consumer should treat like `legacy`.
+     */
+    actorDisclosure?: EnterpriseEventActorDisclosure;
+}
 interface EnterpriseEventPublisher {
-    publish(event: EnterpriseEventEnvelope, context?: {
-        signal: AbortSignal;
-    }): Promise<void>;
+    publish(event: EnterpriseEventEnvelope, context?: EnterpriseEventPublishContext): Promise<void>;
 }
 interface OutboxRelayOptions<TDb> {
     store: OutboxPlatformHostStore<TDb>;
@@ -966,6 +1251,10 @@ interface OutboxRelayResult {
     deadLettered: number;
 }
 declare function runOutboxRelayCycle<TDb>(options: OutboxRelayOptions<TDb>): Promise<OutboxRelayResult>;
+/**
+ * A copy with its own Date fields and trace context. The event payload and
+ * provenance are shallow: the copy shares them with the record, as before.
+ */
 declare function cloneOutboxRecord(record: OutboxRecord): OutboxRecord;
 
 interface PlatformHostSqlResult<Row = Record<string, unknown>> {
@@ -990,7 +1279,7 @@ interface PostgresPlatformHostTransactionProvider<TDb> {
     run<TResult>(run: (context: PostgresPlatformHostTransactionContext<TDb>) => Promise<TResult>): Promise<TResult>;
 }
 /** Durable mutation-pipeline ledger for Databricks Lakebase or standard Postgres. */
-declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb> {
+declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostStore<TDb>, ApprovalPlatformHostStore<TDb>, GovernancePlatformHostStore<TDb>, OutboxPlatformHostStore<TDb>, OutboxRequeuePlatformHostStore<TDb> {
     readonly db: TDb;
     private readonly sql;
     readonly transactionWithEvents?: AtomicMutationPlatformHostStore<TDb>["transactionWithEvents"];
@@ -1041,6 +1330,13 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
         spaceId?: string;
         statuses?: OutboxStatus[];
     }): Promise<OutboxRecord[]>;
+    getOutboxRecord(id: string, tenantId: string, spaceId: string): Promise<OutboxRecord | undefined>;
+    requeueOutboxDeadLetter(input: RequeueOutboxDeadLetterStoreInput): Promise<RequeueOutboxDeadLetterStoreResult>;
+    listOutboxRequeues(input: {
+        tenantId: string;
+        spaceId: string;
+        outboxId?: string;
+    }): Promise<OutboxRequeueRecord[]>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
@@ -1066,7 +1362,7 @@ interface PostgresMigration {
 declare function applyPostgresMigrations(client: PlatformHostSqlClient, migrations: readonly PostgresMigration[]): Promise<void>;
 
 declare const PARAMETER_DIGEST_ALGORITHM: "fabric-canonical-json-sha256-v1";
-declare function canonicalJson(value: unknown): string;
+
 declare function digestParameters(parameters: unknown): string;
 
 /**
@@ -1229,4 +1525,4 @@ declare function tenantIsolationChecks(): readonly TenantIsolationCheck[];
 /** Run every check, returning each result rather than throwing on the first. */
 declare function runTenantIsolationChecks(subject: TenantIsolationSubject): Promise<TenantIsolationResult>;
 
-export { type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventEnvelope, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, canonicalJson, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };
+export { ActionAdmissionError, type ActionAdmissionRefusal, type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventActorDisclosure, type EnterpriseEventEnvelope, type EnterpriseEventPublishContext, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxActorDisclosure, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxRequeueAuthorizationInput, type OutboxRequeueHost, type OutboxRequeuePlatformHostStore, type OutboxRequeueRecord, type OutboxRequeueRefusal, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type RequeueOutboxDeadLetterInput, type RequeueOutboxDeadLetterRefusal, type RequeueOutboxDeadLetterResult, type RequeueOutboxDeadLetterStoreInput, type RequeueOutboxDeadLetterStoreResult, type ResolvePoliciesInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, outboxActorDisclosure, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };