@fabricorg/platform-host 7.4.0 → 7.5.0

package/dist/index.d.cts

@@ -217,13 +217,15 @@ declare class ActionAdmissionError extends Error {
     /** The check's own code, present only for `refused`. */
     refusalCode?: string | undefined);
 }
-type ExternalCompletionRefusal = "still_executing" | "not_found" | "not_awaiting" | "immediate_contract" | "reference_mismatch" | "provider_mismatch" | "invalid_completion" | "result_invalid";
+type ExternalCompletionRefusal = "still_executing" | "not_found" | "not_awaiting" | "immediate_contract" | "reference_mismatch" | "provider_mismatch" | "invalid_completion" | "result_invalid" | "redaction_failed";
 /**
  * Why a completion was not applied, typed so a webhook handler can answer
  * the external system correctly: `retryable` means the invocation is still
  * being finalized and the same callback will be accepted once it parks, so
  * answer with something the sender retries; anything else is permanent and
- * a retry will get the same refusal.
+ * a retry will get the same refusal without a configuration/input change.
+ * `redaction_failed` means completion result or error-text redaction failed before writes;
+ * it is not retryable.
  */
 declare class ExternalCompletionError extends Error {
     readonly refusal: ExternalCompletionRefusal;
@@ -432,6 +434,12 @@ interface AdapterInvocationRecord {
 }
 interface CreateActionInvocationInput extends Omit<ActionInvocationRecord, "createdAt" | "updatedAt" | "attemptCount" | "leaseOwner" | "leaseExpiresAt" | "leaseToken"> {
 }
+/** Scope of an adapter checkpoint within its owning action invocation. */
+interface AdapterInvocationScope {
+    tenantId: string;
+    spaceId: string;
+    actionInvocationId: string;
+}
 interface PlatformHostStore<TDb> {
     readonly db: TDb;
     /**
@@ -445,10 +453,32 @@ interface PlatformHostStore<TDb> {
     updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: ActionInvocationPatch): Promise<void>;
     appendPolicyEvaluation(record: PolicyEvaluationRecord): Promise<void>;
     createAdapterInvocation(record: AdapterInvocationRecord): Promise<void>;
-    getAdapterInvocation(id: string): Promise<AdapterInvocationRecord | undefined>;
-    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>): Promise<void>;
+    /**
+     * Host supplies scope from its store-loaded invocation at adapter call sites.
+     * When supplied, stores must match tenant, space, and action invocation:
+     * an out-of-scope record returns undefined. Optional for compatibility with
+     * existing custom stores and direct callers; tenantIsolationChecks tests
+     * scoped read and write conformance.
+     */
+    getAdapterInvocation(id: string, scope?: AdapterInvocationScope): Promise<AdapterInvocationRecord | undefined>;
+    /**
+     * Match all three scope fields when supplied, changing nothing outside it
+     * (a not-found error is permitted). Host supplies scope as described above;
+     * optional only for compatibility with existing stores and direct callers.
+     */
+    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>, scope?: AdapterInvocationScope): Promise<void>;
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
+    /**
+     * Return the state and invocation writer of the same event selected by
+     * getEntityState, scoped to this subject and tenant/space. Return undefined
+     * when that event or its invocation provenance is unavailable. Transaction
+     * implementations include pending events visible to getEntityState.
+     */
+    getEntityStateSource?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
 }
 /**
@@ -475,6 +505,16 @@ interface PlatformHostMutationTransaction<TDb> {
     appendEventWithOutbox?(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
     listEvents(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
+    /**
+     * Return the state and invocation writer of the same event selected by
+     * getEntityState, scoped to this subject and tenant/space. Return undefined
+     * when that event or its invocation provenance is unavailable. Transaction
+     * implementations include pending events visible to getEntityState.
+     */
+    getEntityStateSource?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: ActionInvocationPatch): Promise<void>;
     updateLeasedActionInvocation?(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
@@ -963,6 +1003,21 @@ interface PlatformActionWorkerCycleResult {
     failed: number;
     /** Present when claimed agent work was durably parked instead of failing. */
     waitingForApproval?: number;
+    /**
+     * Present only when > 0: claimed invocations whose execution threw a
+     * RetryableExecutionError (counted by error type, not by where it was thrown).
+     * The row stays leased and a later claim retries it; excluded from failed.
+     */
+    deferred?: number;
+}
+/** Origin of error text redacted before Host records or returns it. */
+interface ErrorTextRedactionContext {
+    actionId: ActionId;
+    source: "handler" | "adapter" | "external_completion" | "execution";
+    adapterType?: string;
+    operation?: string;
+    /** Adapter vendor or external completion provider. */
+    provider?: string;
 }
 interface PlatformHostOptions<TDb> {
     store: PlatformHostStore<TDb>;
@@ -979,8 +1034,24 @@ interface PlatformHostOptions<TDb> {
      * `circuitBreaker` config, on first use, and none for adapters without one.
      * Pass a shared registry or a custom provider to share breakers between
      * Host instances, receive breaker telemetry, or set manual overrides.
+     * The default key shares failures across tenants and vendors in a registry.
+     * Use `new AdapterCircuitBreakerRegistry({ key: scopedAdapterCircuitBreakerKey })`
+     * for tenant/space/vendor isolation. Host passes trusted tenant/space scope
+     * to the provider. The registry keeps the first config seen for a key;
+     * later conflicting configs reuse that breaker without throwing. Breakers
+     * are never evicted, so scoped keys keep one breaker per scope seen.
      */
     adapterCircuitBreakers?: AdapterCircuitBreakerProvider;
+    /**
+     * Positive integer attempt cap for RetryableExecutionError during governance,
+     * before policy-evaluation persistence (default 5). A leased, idempotent action
+     * below the cap is left running for worker reclaim after lease expiry.
+     * Inline execution, approval resume, exhausted attempts, and non-idempotent
+     * actions fail. Policy persistence, obligation listing/resolution/persistence, state-machine checks,
+     * the handler transaction, handlers, adapters, and finalization are excluded;
+     * their existing failure/reconciliation/recovery semantics apply.
+     */
+    retryableExecutionMaxAttempts?: number;
     dispatcher?: PlatformActionDispatcher;
     services?: FabricRuntimeServices;
     idempotency?: {
@@ -1029,6 +1100,7 @@ interface PlatformHostOptions<TDb> {
         input: Record<string, unknown>;
         startedAt: Date;
         completedAt: Date;
+        /** Adapter output after redactAdapterOutput, when configured. */
         output: Record<string, unknown>;
     }) => Promise<ExecutionAttestation | undefined> | ExecutionAttestation | undefined;
     /** Package/provider/ruleset generations persisted with every newly created invocation. */
@@ -1076,6 +1148,33 @@ interface PlatformHostOptions<TDb> {
     /** Handler-result fields consumed by extractEvents and omitted from the durable result. */
     eventResultFields?: readonly string[];
     redactAdapterInput?: (actionId: ActionId, adapterType: string, operation: string, input: Record<string, unknown>) => Record<string, unknown>;
+    /**
+     * Redact successful adapter output before row/event persistence and attestation extraction.
+     * A throwing hook or a null, array or non-object return withholds output and requires reconciliation.
+     * Class instances and Dates are accepted, matching the adapter output record contract.
+     * Keep redactors deterministic and stable across deploys.
+     * Accepted-operation references are read from the original adapter result.
+     */
+    redactAdapterOutput?: (actionId: ActionId, adapterType: string, operation: string, output: Record<string, unknown>) => Record<string, unknown>;
+    /**
+     * Redact originating handler, adapter, completion and caught execution error text.
+     * Host-authored fixed text bypasses this hook; circuit and consistency errors use adapter context.
+     * Empty originating text bypasses the hook unchanged. For non-empty input, throwing or returning
+     * a non-string or empty string uses a placeholder on execution paths, but refuses a completion
+     * as redaction_failed before writes. State-machine `transition.error` text uses `source: "handler"`.
+     * Keep redactors deterministic and stable across deploys: changed output can make a repeat
+     * completion look like different evidence.
+     */
+    redactErrorText?: (context: ErrorTextRedactionContext, message: string) => string;
+    /**
+     * Redact completion results before merging, schema validation, persistence and digesting.
+     * Contradiction detection compares retained values; legacy raw digests also match repeats.
+     * A throwing hook or a null, array or non-object return refuses as redaction_failed before writes.
+     * Class instances and Dates are accepted by the same record predicate as adapter output.
+     * Keep redactors deterministic and stable across deploys: changes can make a repeat look like
+     * different evidence. A matching legacy raw digest is acknowledged before invoking hooks.
+     */
+    redactExternalCompletionResult?: (actionId: ActionId, provider: string, result: Record<string, unknown>) => Record<string, unknown>;
     adapterEventSubject?: (actionId: ActionId, parameters: unknown, handlerResult: Record<string, unknown>) => {
         subjectType: string;
         subjectId: string;
@@ -1173,8 +1272,8 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     listExecutionAttestations(actionInvocationId: string, tenantId: string, spaceId: string): Promise<ExecutionAttestationRecord[]>;
     appendExternalReconciliation(record: ExternalReconciliationRecord): Promise<void>;
     createAdapterInvocation(record: AdapterInvocationRecord): Promise<void>;
-    getAdapterInvocation(id: string): Promise<AdapterInvocationRecord | undefined>;
-    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>): Promise<void>;
+    getAdapterInvocation(id: string, scope?: AdapterInvocationScope): Promise<AdapterInvocationRecord | undefined>;
+    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>, scope?: AdapterInvocationScope): Promise<void>;
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
@@ -1208,6 +1307,10 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     }): Promise<OutboxRequeueRecord[]>;
     private requireLeasedOutbox;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
+    getEntityStateSource(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
     getHealthCounts(input: PlatformHostHealthQuery): Promise<PlatformHostHealthCounts>;
@@ -1304,8 +1407,8 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
     listExecutionAttestations(actionInvocationId: string, tenantId: string, spaceId: string): Promise<ExecutionAttestationRecord[]>;
     appendExternalReconciliation(record: ExternalReconciliationRecord): Promise<void>;
     createAdapterInvocation(record: AdapterInvocationRecord): Promise<void>;
-    getAdapterInvocation(id: string): Promise<AdapterInvocationRecord | undefined>;
-    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>): Promise<void>;
+    getAdapterInvocation(id: string, scope?: AdapterInvocationScope): Promise<AdapterInvocationRecord | undefined>;
+    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>, scope?: AdapterInvocationScope): Promise<void>;
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
@@ -1338,6 +1441,10 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
         outboxId?: string;
     }): Promise<OutboxRequeueRecord[]>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
+    getEntityStateSource(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
     getHealthCounts(input: PlatformHostHealthQuery): Promise<PlatformHostHealthCounts>;
@@ -1493,13 +1600,13 @@ interface TenantIsolationSubject<TDb = unknown> {
     }>;
     /**
      * Optional: put the host and store back to a known state before a check.
-     * The checks tolerate accumulated state, and each cleans up any row it
+     * The checks tolerate accumulated state, and each retires any row it
      * creates directly, so this exists for subjects whose store is shared.
      */
     reset?(): Promise<void> | void;
 }
 interface TenantIsolationCheck {
-    id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1";
+    id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1" | "fabric.tenancy.adapter-invocation-read-scoped.v1" | "fabric.tenancy.adapter-invocation-write-scoped.v1";
     run(subject: TenantIsolationSubject): Promise<string[]>;
 }
 interface TenantIsolationResult {
@@ -1514,15 +1621,16 @@ interface TenantIsolationResult {
 /**
  * The suite any deployment of the host must pass before it claims isolation.
  *
- * Six checks: an invocation cannot be read, executed, or completed under
+ * Eight checks: an invocation cannot be read, executed, or completed under
  * another tenant's scope; an idempotency key is a tenant's own, so the same
  * key in two tenants is two invocations; a tenant's event stream carries no
- * other tenant's events; a worker scoped to one tenant never claims another's
- * work; and, when the subject lends a read, a viewer in the other tenant sees
- * nothing of ours.
+ * other tenant's events; a worker scoped to one tenant does not claim another's
+ * work; an adapter checkpoint cannot be read or written under another tenant,
+ * space, or owning invocation; and, when the subject lends a read, a viewer in
+ * the other tenant sees nothing of ours.
  */
 declare function tenantIsolationChecks(): readonly TenantIsolationCheck[];
 /** Run every check, returning each result rather than throwing on the first. */
 declare function runTenantIsolationChecks(subject: TenantIsolationSubject): Promise<TenantIsolationResult>;
 
-export { ActionAdmissionError, type ActionAdmissionRefusal, type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventActorDisclosure, type EnterpriseEventEnvelope, type EnterpriseEventPublishContext, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxActorDisclosure, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxRequeueAuthorizationInput, type OutboxRequeueHost, type OutboxRequeuePlatformHostStore, type OutboxRequeueRecord, type OutboxRequeueRefusal, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type RequeueOutboxDeadLetterInput, type RequeueOutboxDeadLetterRefusal, type RequeueOutboxDeadLetterResult, type RequeueOutboxDeadLetterStoreInput, type RequeueOutboxDeadLetterStoreResult, type ResolvePoliciesInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, outboxActorDisclosure, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };
+export { ActionAdmissionError, type ActionAdmissionRefusal, type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationScope, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventActorDisclosure, type EnterpriseEventEnvelope, type EnterpriseEventPublishContext, type EnterpriseEventPublisher, type ErrorTextRedactionContext, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxActorDisclosure, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxRequeueAuthorizationInput, type OutboxRequeueHost, type OutboxRequeuePlatformHostStore, type OutboxRequeueRecord, type OutboxRequeueRefusal, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type RequeueOutboxDeadLetterInput, type RequeueOutboxDeadLetterRefusal, type RequeueOutboxDeadLetterResult, type RequeueOutboxDeadLetterStoreInput, type RequeueOutboxDeadLetterStoreResult, type ResolvePoliciesInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, outboxActorDisclosure, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };

package/dist/index.d.ts

@@ -217,13 +217,15 @@ declare class ActionAdmissionError extends Error {
     /** The check's own code, present only for `refused`. */
     refusalCode?: string | undefined);
 }
-type ExternalCompletionRefusal = "still_executing" | "not_found" | "not_awaiting" | "immediate_contract" | "reference_mismatch" | "provider_mismatch" | "invalid_completion" | "result_invalid";
+type ExternalCompletionRefusal = "still_executing" | "not_found" | "not_awaiting" | "immediate_contract" | "reference_mismatch" | "provider_mismatch" | "invalid_completion" | "result_invalid" | "redaction_failed";
 /**
  * Why a completion was not applied, typed so a webhook handler can answer
  * the external system correctly: `retryable` means the invocation is still
  * being finalized and the same callback will be accepted once it parks, so
  * answer with something the sender retries; anything else is permanent and
- * a retry will get the same refusal.
+ * a retry will get the same refusal without a configuration/input change.
+ * `redaction_failed` means completion result or error-text redaction failed before writes;
+ * it is not retryable.
  */
 declare class ExternalCompletionError extends Error {
     readonly refusal: ExternalCompletionRefusal;
@@ -432,6 +434,12 @@ interface AdapterInvocationRecord {
 }
 interface CreateActionInvocationInput extends Omit<ActionInvocationRecord, "createdAt" | "updatedAt" | "attemptCount" | "leaseOwner" | "leaseExpiresAt" | "leaseToken"> {
 }
+/** Scope of an adapter checkpoint within its owning action invocation. */
+interface AdapterInvocationScope {
+    tenantId: string;
+    spaceId: string;
+    actionInvocationId: string;
+}
 interface PlatformHostStore<TDb> {
     readonly db: TDb;
     /**
@@ -445,10 +453,32 @@ interface PlatformHostStore<TDb> {
     updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: ActionInvocationPatch): Promise<void>;
     appendPolicyEvaluation(record: PolicyEvaluationRecord): Promise<void>;
     createAdapterInvocation(record: AdapterInvocationRecord): Promise<void>;
-    getAdapterInvocation(id: string): Promise<AdapterInvocationRecord | undefined>;
-    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>): Promise<void>;
+    /**
+     * Host supplies scope from its store-loaded invocation at adapter call sites.
+     * When supplied, stores must match tenant, space, and action invocation:
+     * an out-of-scope record returns undefined. Optional for compatibility with
+     * existing custom stores and direct callers; tenantIsolationChecks tests
+     * scoped read and write conformance.
+     */
+    getAdapterInvocation(id: string, scope?: AdapterInvocationScope): Promise<AdapterInvocationRecord | undefined>;
+    /**
+     * Match all three scope fields when supplied, changing nothing outside it
+     * (a not-found error is permitted). Host supplies scope as described above;
+     * optional only for compatibility with existing stores and direct callers.
+     */
+    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>, scope?: AdapterInvocationScope): Promise<void>;
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
+    /**
+     * Return the state and invocation writer of the same event selected by
+     * getEntityState, scoped to this subject and tenant/space. Return undefined
+     * when that event or its invocation provenance is unavailable. Transaction
+     * implementations include pending events visible to getEntityState.
+     */
+    getEntityStateSource?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
 }
 /**
@@ -475,6 +505,16 @@ interface PlatformHostMutationTransaction<TDb> {
     appendEventWithOutbox?(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
     listEvents(tenantId: string, spaceId: string): Promise<AssetEventEnvelope[]>;
+    /**
+     * Return the state and invocation writer of the same event selected by
+     * getEntityState, scoped to this subject and tenant/space. Return undefined
+     * when that event or its invocation provenance is unavailable. Transaction
+     * implementations include pending events visible to getEntityState.
+     */
+    getEntityStateSource?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState?(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     updateActionInvocation(id: string, tenantId: string, spaceId: string, patch: ActionInvocationPatch): Promise<void>;
     updateLeasedActionInvocation?(input: UpdateLeasedActionInvocationInput): Promise<boolean>;
@@ -963,6 +1003,21 @@ interface PlatformActionWorkerCycleResult {
     failed: number;
     /** Present when claimed agent work was durably parked instead of failing. */
     waitingForApproval?: number;
+    /**
+     * Present only when > 0: claimed invocations whose execution threw a
+     * RetryableExecutionError (counted by error type, not by where it was thrown).
+     * The row stays leased and a later claim retries it; excluded from failed.
+     */
+    deferred?: number;
+}
+/** Origin of error text redacted before Host records or returns it. */
+interface ErrorTextRedactionContext {
+    actionId: ActionId;
+    source: "handler" | "adapter" | "external_completion" | "execution";
+    adapterType?: string;
+    operation?: string;
+    /** Adapter vendor or external completion provider. */
+    provider?: string;
 }
 interface PlatformHostOptions<TDb> {
     store: PlatformHostStore<TDb>;
@@ -979,8 +1034,24 @@ interface PlatformHostOptions<TDb> {
      * `circuitBreaker` config, on first use, and none for adapters without one.
      * Pass a shared registry or a custom provider to share breakers between
      * Host instances, receive breaker telemetry, or set manual overrides.
+     * The default key shares failures across tenants and vendors in a registry.
+     * Use `new AdapterCircuitBreakerRegistry({ key: scopedAdapterCircuitBreakerKey })`
+     * for tenant/space/vendor isolation. Host passes trusted tenant/space scope
+     * to the provider. The registry keeps the first config seen for a key;
+     * later conflicting configs reuse that breaker without throwing. Breakers
+     * are never evicted, so scoped keys keep one breaker per scope seen.
      */
     adapterCircuitBreakers?: AdapterCircuitBreakerProvider;
+    /**
+     * Positive integer attempt cap for RetryableExecutionError during governance,
+     * before policy-evaluation persistence (default 5). A leased, idempotent action
+     * below the cap is left running for worker reclaim after lease expiry.
+     * Inline execution, approval resume, exhausted attempts, and non-idempotent
+     * actions fail. Policy persistence, obligation listing/resolution/persistence, state-machine checks,
+     * the handler transaction, handlers, adapters, and finalization are excluded;
+     * their existing failure/reconciliation/recovery semantics apply.
+     */
+    retryableExecutionMaxAttempts?: number;
     dispatcher?: PlatformActionDispatcher;
     services?: FabricRuntimeServices;
     idempotency?: {
@@ -1029,6 +1100,7 @@ interface PlatformHostOptions<TDb> {
         input: Record<string, unknown>;
         startedAt: Date;
         completedAt: Date;
+        /** Adapter output after redactAdapterOutput, when configured. */
         output: Record<string, unknown>;
     }) => Promise<ExecutionAttestation | undefined> | ExecutionAttestation | undefined;
     /** Package/provider/ruleset generations persisted with every newly created invocation. */
@@ -1076,6 +1148,33 @@ interface PlatformHostOptions<TDb> {
     /** Handler-result fields consumed by extractEvents and omitted from the durable result. */
     eventResultFields?: readonly string[];
     redactAdapterInput?: (actionId: ActionId, adapterType: string, operation: string, input: Record<string, unknown>) => Record<string, unknown>;
+    /**
+     * Redact successful adapter output before row/event persistence and attestation extraction.
+     * A throwing hook or a null, array or non-object return withholds output and requires reconciliation.
+     * Class instances and Dates are accepted, matching the adapter output record contract.
+     * Keep redactors deterministic and stable across deploys.
+     * Accepted-operation references are read from the original adapter result.
+     */
+    redactAdapterOutput?: (actionId: ActionId, adapterType: string, operation: string, output: Record<string, unknown>) => Record<string, unknown>;
+    /**
+     * Redact originating handler, adapter, completion and caught execution error text.
+     * Host-authored fixed text bypasses this hook; circuit and consistency errors use adapter context.
+     * Empty originating text bypasses the hook unchanged. For non-empty input, throwing or returning
+     * a non-string or empty string uses a placeholder on execution paths, but refuses a completion
+     * as redaction_failed before writes. State-machine `transition.error` text uses `source: "handler"`.
+     * Keep redactors deterministic and stable across deploys: changed output can make a repeat
+     * completion look like different evidence.
+     */
+    redactErrorText?: (context: ErrorTextRedactionContext, message: string) => string;
+    /**
+     * Redact completion results before merging, schema validation, persistence and digesting.
+     * Contradiction detection compares retained values; legacy raw digests also match repeats.
+     * A throwing hook or a null, array or non-object return refuses as redaction_failed before writes.
+     * Class instances and Dates are accepted by the same record predicate as adapter output.
+     * Keep redactors deterministic and stable across deploys: changes can make a repeat look like
+     * different evidence. A matching legacy raw digest is acknowledged before invoking hooks.
+     */
+    redactExternalCompletionResult?: (actionId: ActionId, provider: string, result: Record<string, unknown>) => Record<string, unknown>;
     adapterEventSubject?: (actionId: ActionId, parameters: unknown, handlerResult: Record<string, unknown>) => {
         subjectType: string;
         subjectId: string;
@@ -1173,8 +1272,8 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     listExecutionAttestations(actionInvocationId: string, tenantId: string, spaceId: string): Promise<ExecutionAttestationRecord[]>;
     appendExternalReconciliation(record: ExternalReconciliationRecord): Promise<void>;
     createAdapterInvocation(record: AdapterInvocationRecord): Promise<void>;
-    getAdapterInvocation(id: string): Promise<AdapterInvocationRecord | undefined>;
-    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>): Promise<void>;
+    getAdapterInvocation(id: string, scope?: AdapterInvocationScope): Promise<AdapterInvocationRecord | undefined>;
+    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>, scope?: AdapterInvocationScope): Promise<void>;
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
@@ -1208,6 +1307,10 @@ declare class MemoryPlatformHostStore<TDb> implements RecoverablePlatformHostSto
     }): Promise<OutboxRequeueRecord[]>;
     private requireLeasedOutbox;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
+    getEntityStateSource(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
     getHealthCounts(input: PlatformHostHealthQuery): Promise<PlatformHostHealthCounts>;
@@ -1304,8 +1407,8 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
     listExecutionAttestations(actionInvocationId: string, tenantId: string, spaceId: string): Promise<ExecutionAttestationRecord[]>;
     appendExternalReconciliation(record: ExternalReconciliationRecord): Promise<void>;
     createAdapterInvocation(record: AdapterInvocationRecord): Promise<void>;
-    getAdapterInvocation(id: string): Promise<AdapterInvocationRecord | undefined>;
-    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>): Promise<void>;
+    getAdapterInvocation(id: string, scope?: AdapterInvocationScope): Promise<AdapterInvocationRecord | undefined>;
+    updateAdapterInvocation(id: string, patch: Partial<Pick<AdapterInvocationRecord, "status" | "output" | "error" | "attempt" | "updatedAt">>, scope?: AdapterInvocationScope): Promise<void>;
     appendEvent(event: AssetEventEnvelope): Promise<void>;
     appendEventWithOutbox(event: AssetEventEnvelope, metadata: OutboxEventMetadata): Promise<void>;
     claimOutbox(input: ClaimOutboxInput): Promise<OutboxRecord[]>;
@@ -1338,6 +1441,10 @@ declare class PostgresPlatformHostStore<TDb> implements RecoverablePlatformHostS
         outboxId?: string;
     }): Promise<OutboxRequeueRecord[]>;
     nextEventSequence(tenantId: string, spaceId: string): Promise<number>;
+    getEntityStateSource(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<{
+        state: string;
+        actionInvocationId: string;
+    } | undefined>;
     getEntityState(tenantId: string, spaceId: string, entityType: string, entityId: string): Promise<string | undefined>;
     listActionInvocations(input?: ListActionInvocationsInput): Promise<ActionInvocationRecord[]>;
     getHealthCounts(input: PlatformHostHealthQuery): Promise<PlatformHostHealthCounts>;
@@ -1493,13 +1600,13 @@ interface TenantIsolationSubject<TDb = unknown> {
     }>;
     /**
      * Optional: put the host and store back to a known state before a check.
-     * The checks tolerate accumulated state, and each cleans up any row it
+     * The checks tolerate accumulated state, and each retires any row it
      * creates directly, so this exists for subjects whose store is shared.
      */
     reset?(): Promise<void> | void;
 }
 interface TenantIsolationCheck {
-    id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1";
+    id: "fabric.tenancy.invocation-scoped-read.v1" | "fabric.tenancy.idempotency-key-scoped.v1" | "fabric.tenancy.events-scoped.v1" | "fabric.tenancy.worker-claim-scoped.v1" | "fabric.tenancy.completion-scoped.v1" | "fabric.tenancy.projection-scoped.v1" | "fabric.tenancy.adapter-invocation-read-scoped.v1" | "fabric.tenancy.adapter-invocation-write-scoped.v1";
     run(subject: TenantIsolationSubject): Promise<string[]>;
 }
 interface TenantIsolationResult {
@@ -1514,15 +1621,16 @@ interface TenantIsolationResult {
 /**
  * The suite any deployment of the host must pass before it claims isolation.
  *
- * Six checks: an invocation cannot be read, executed, or completed under
+ * Eight checks: an invocation cannot be read, executed, or completed under
  * another tenant's scope; an idempotency key is a tenant's own, so the same
  * key in two tenants is two invocations; a tenant's event stream carries no
- * other tenant's events; a worker scoped to one tenant never claims another's
- * work; and, when the subject lends a read, a viewer in the other tenant sees
- * nothing of ours.
+ * other tenant's events; a worker scoped to one tenant does not claim another's
+ * work; an adapter checkpoint cannot be read or written under another tenant,
+ * space, or owning invocation; and, when the subject lends a read, a viewer in
+ * the other tenant sees nothing of ours.
  */
 declare function tenantIsolationChecks(): readonly TenantIsolationCheck[];
 /** Run every check, returning each result rather than throwing on the first. */
 declare function runTenantIsolationChecks(subject: TenantIsolationSubject): Promise<TenantIsolationResult>;
 
-export { ActionAdmissionError, type ActionAdmissionRefusal, type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventActorDisclosure, type EnterpriseEventEnvelope, type EnterpriseEventPublishContext, type EnterpriseEventPublisher, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxActorDisclosure, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxRequeueAuthorizationInput, type OutboxRequeueHost, type OutboxRequeuePlatformHostStore, type OutboxRequeueRecord, type OutboxRequeueRefusal, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type RequeueOutboxDeadLetterInput, type RequeueOutboxDeadLetterRefusal, type RequeueOutboxDeadLetterResult, type RequeueOutboxDeadLetterStoreInput, type RequeueOutboxDeadLetterStoreResult, type ResolvePoliciesInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, outboxActorDisclosure, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };
+export { ActionAdmissionError, type ActionAdmissionRefusal, type ActionApprovalDecision, type ActionAuthorizationInput, type ActionExecutionAuthorizationInput, type ActionExecutionReason, type ActionInvocationPatch, type ActionInvocationRecord, type AdapterInvocationRecord, type AdapterInvocationScope, type AdapterInvocationStatus, type AdapterReconciliationOutcome, type ApprovalDecisionTransitionResult, type ApprovalPlatformHostStore, type AtomicMutationPlatformHostStore, type AuthorizationBinding, type AuthorizationGoverningMoment, type AuthorizationReconciliationOutcome, type BeginApprovalDecisionInput, type ClaimActionInvocationsInput, type ClaimOutboxInput, type CreateActionInvocationInput, type CreateDurableSagaParentLifecycleOptions, type DispatchActionInput, type DispatchActionResult, type EnterpriseEventActorDisclosure, type EnterpriseEventEnvelope, type EnterpriseEventPublishContext, type EnterpriseEventPublisher, type ErrorTextRedactionContext, type EventPayloadClassification, type ExecuteActionResult, type ExecuteInvocationOptions, type ExecutionAttestationRecord, type ExternalCompletion, ExternalCompletionError, type ExternalCompletionRefusal, type ExternalReconciliationRecord, type GovernancePlatformHostStore, type GovernedActionHost, type HitlDecisionEvidence, type HostCompensationRecord, type HostSagaParentApprovalInput, type HostSagaParentCancellationInput, type HostSagaParentCompletionInput, type HostSagaParentFailureInput, type HostSagaParentLifecycle, type HostSagaParentProgressInput, type HostSagaParentProgressRecord, type IdempotencyConflict, IdempotencyConflictError, type InvocationProvenance, type InvocationSource, type KnownActionExecutionReason, type ListActionInvocationsInput, MemoryPlatformHostStore, type MemoryPlatformHostTransactionProvider, type NamespacedAttributes, type OutboxActorDisclosure, type OutboxEventMetadata, type OutboxPlatformHostStore, type OutboxRecord, type OutboxRelayOptions, type OutboxRelayResult, type OutboxRequeueAuthorizationInput, type OutboxRequeueHost, type OutboxRequeuePlatformHostStore, type OutboxRequeueRecord, type OutboxRequeueRefusal, type OutboxStatus, PARAMETER_DIGEST_ALGORITHM, PLATFORM_HOST_CONTRACT_VERSION, PLATFORM_HOST_HEALTH_CONTRACT_VERSION, PLATFORM_HOST_METRIC_NAMES, type PendingAssetEvent, type PendingExternalCompletion, type PersistedActionApprovalDecision, type PlatformActionDispatcher, type PlatformActionWorkerCycleResult, type PlatformActionWorkerOptions, type PlatformHostAuthorization, type PlatformHostHealthCounts, type PlatformHostHealthOptions, type PlatformHostHealthQuery, type PlatformHostHealthSnapshot, type PlatformHostHealthStatus, type PlatformHostHealthStore, type PlatformHostLifecycleTelemetry, type PlatformHostMetricName, type PlatformHostMetricTelemetry, type PlatformHostMetricType, type PlatformHostMutationTransaction, type PlatformHostOptions, type PlatformHostReadinessReason, type PlatformHostSqlClient, type PlatformHostSqlResult, type PlatformHostStore, type PlatformHostTelemetry, type PlatformHostTelemetryAttribute, type PlatformHostTelemetryEventName, type PlatformHostTelemetryHook, type PlatformHostTelemetryInput, type PlatformHostTelemetryRecord, type PlatformHostWorkerHealthInput, type PolicyEvaluationRecord, type PolicyObligationRecord, type PostgresMigration, PostgresPlatformHostStore, type PostgresPlatformHostTransactionContext, type PostgresPlatformHostTransactionProvider, type ReconcileOverdueCompletionsInput, type RecordedExternalCompletion, type RecoverablePlatformHostStore, type RenewActionInvocationLeaseInput, type RequeueOutboxDeadLetterInput, type RequeueOutboxDeadLetterRefusal, type RequeueOutboxDeadLetterResult, type RequeueOutboxDeadLetterStoreInput, type RequeueOutboxDeadLetterStoreResult, type ResolvePoliciesInput, type SubmitActionInput, type SubmitActionResult, type TenantIsolationCheck, type TenantIsolationResult, type TenantIsolationScope, type TenantIsolationSubject, type UpdateLeasedActionInvocationInput, applyPostgresMigrations, cloneOutboxRecord, createDurableSagaParentLifecycle, createGovernedActionHost, createStoreBackedActionDispatcher, digestParameters, emitPlatformHostTelemetry, getPlatformHostHealthSnapshot, outboxActorDisclosure, runOutboxRelayCycle, runPlatformActionWorker, runPlatformActionWorkerCycle, runTenantIsolationChecks, tenantIsolationChecks, toEnterpriseEventEnvelope };