@fabricorg/platform-host 8.0.0 → 8.1.1

package/dist/index.cjs

@@ -335,8 +335,12 @@ function redactErrorText(hook, context, message) {
 	const result = tryRedactErrorText(hook, context, message);
 	return result.success ? result.text : "Error text withheld: the error-text redactor failed.";
 }
+const LIFECYCLE_KEY_LIMIT = 96;
 function lifecycleId(prefix, invocationId, key) {
-	return `${prefix}_${invocationId}_${key.replace(/[^a-zA-Z0-9_-]/g, "_").slice(0, 96)}`;
+	const safeKey = key.replace(/[^a-zA-Z0-9_-]/g, "_");
+	if (safeKey.length <= LIFECYCLE_KEY_LIMIT) return `${prefix}_${invocationId}_${safeKey}`;
+	const digest = (0, crypto.createHash)("sha256").update(key).digest("hex").slice(0, 32);
+	return `${prefix}_${invocationId}_${safeKey.slice(0, LIFECYCLE_KEY_LIMIT - digest.length)}_${digest}`;
 }
 function emitInvocationStatusTelemetry(invocation, status, telemetry, occurredAt, previousStatus) {
 	if (!status || status === previousStatus) return;
@@ -5538,7 +5542,7 @@ function createDurableSagaParentLifecycle(options) {
 }
 //#endregion
 //#region src/tenant-isolation.ts
-function fail(message) {
+function fail$1(message) {
 	throw new Error(message);
 }
 function submitInput(subject, scope, idempotencyKey) {
@@ -5554,7 +5558,7 @@ function submitInput(subject, scope, idempotencyKey) {
 }
 async function adapterProbe(subject) {
 	await subject.reset?.();
-	if (subject.ours.tenantId === subject.theirs.tenantId) fail("the two scopes must be in different tenants");
+	if (subject.ours.tenantId === subject.theirs.tenantId) fail$1("the two scopes must be in different tenants");
 	const suffix = globalThis.crypto.randomUUID();
 	const scope = {
 		tenantId: subject.ours.tenantId,
@@ -5642,9 +5646,9 @@ function tenantIsolationChecks() {
 			id: "fabric.tenancy.invocation-scoped-read.v1",
 			async run(subject) {
 				await subject.reset?.();
-				if (subject.ours.tenantId === subject.theirs.tenantId) fail("the two scopes must be in different tenants");
+				if (subject.ours.tenantId === subject.theirs.tenantId) fail$1("the two scopes must be in different tenants");
 				const ours = await subject.host.submitAction(submitInput(subject, subject.ours, "iso:read"));
-				if (await subject.store.getActionInvocation(ours.actionInvocationId, subject.theirs.tenantId, subject.theirs.spaceId) !== void 0) fail("an invocation was readable under another tenant's scope");
+				if (await subject.store.getActionInvocation(ours.actionInvocationId, subject.theirs.tenantId, subject.theirs.spaceId) !== void 0) fail$1("an invocation was readable under another tenant's scope");
 				const shape = (record) => JSON.stringify({
 					status: record?.status,
 					result: record?.result,
@@ -5653,7 +5657,7 @@ function tenantIsolationChecks() {
 					updatedAt: record?.updatedAt
 				});
 				const before = await subject.store.getActionInvocation(ours.actionInvocationId, subject.ours.tenantId, subject.ours.spaceId);
-				if (!before) fail("our own invocation was not readable under our scope, so the check proves nothing");
+				if (!before) fail$1("our own invocation was not readable under our scope, so the check proves nothing");
 				const untouched = shape(before);
 				let crossExecute;
 				try {
@@ -5661,8 +5665,8 @@ function tenantIsolationChecks() {
 				} catch {
 					crossExecute = void 0;
 				}
-				if (crossExecute !== void 0) fail("an invocation was executable under another tenant's scope");
-				if (untouched !== shape(await subject.store.getActionInvocation(ours.actionInvocationId, subject.ours.tenantId, subject.ours.spaceId))) fail("an execution attempted under another tenant's scope changed our invocation");
+				if (crossExecute !== void 0) fail$1("an invocation was executable under another tenant's scope");
+				if (untouched !== shape(await subject.store.getActionInvocation(ours.actionInvocationId, subject.ours.tenantId, subject.ours.spaceId))) fail$1("an execution attempted under another tenant's scope changed our invocation");
 				return ["invocation readable under our scope, invisible and untouched under the other tenant's"];
 			}
 		},
@@ -5672,9 +5676,9 @@ function tenantIsolationChecks() {
 				await subject.reset?.();
 				const ours = await subject.host.submitAction(submitInput(subject, subject.ours, "iso:shared-key"));
 				const again = await subject.host.submitAction(submitInput(subject, subject.ours, "iso:shared-key"));
-				if (ours.actionInvocationId !== again.actionInvocationId) fail("the same idempotency key in one tenant produced two invocations, so the key is not doing anything and the check proves nothing");
+				if (ours.actionInvocationId !== again.actionInvocationId) fail$1("the same idempotency key in one tenant produced two invocations, so the key is not doing anything and the check proves nothing");
 				const theirs = await subject.host.submitAction(submitInput(subject, subject.theirs, "iso:shared-key"));
-				if (ours.actionInvocationId === theirs.actionInvocationId) fail("the same idempotency key in two tenants resolved to one invocation");
+				if (ours.actionInvocationId === theirs.actionInvocationId) fail$1("the same idempotency key in two tenants resolved to one invocation");
 				return ["one idempotency key: one invocation within a tenant, two across tenants"];
 			}
 		},
@@ -5684,10 +5688,10 @@ function tenantIsolationChecks() {
 				await subject.reset?.();
 				const ours = await subject.host.submitAction(submitInput(subject, subject.ours, "iso:events"));
 				const leaked = (await subject.store.listEvents(subject.theirs.tenantId, subject.theirs.spaceId)).filter((event) => event.tenantId === subject.ours.tenantId || event.actionInvocationId === ours.actionInvocationId);
-				if (leaked.length > 0) fail(`${leaked.length} of our events appeared in the other tenant's stream`);
+				if (leaked.length > 0) fail$1(`${leaked.length} of our events appeared in the other tenant's stream`);
 				const ourEvents = await subject.store.listEvents(subject.ours.tenantId, subject.ours.spaceId);
-				if (!ourEvents.some((event) => event.actionInvocationId === ours.actionInvocationId)) fail("our own stream does not carry the event we just caused, so the check proves nothing");
-				if (ourEvents.some((event) => event.tenantId !== subject.ours.tenantId)) fail("another tenant's event appeared in our stream");
+				if (!ourEvents.some((event) => event.actionInvocationId === ours.actionInvocationId)) fail$1("our own stream does not carry the event we just caused, so the check proves nothing");
+				if (ourEvents.some((event) => event.tenantId !== subject.ours.tenantId)) fail$1("another tenant's event appeared in our stream");
 				return ["event streams carry their own tenant's events and only those"];
 			}
 		},
@@ -5716,14 +5720,14 @@ function tenantIsolationChecks() {
 						limit: 1e3,
 						tenantId: subject.theirs.tenantId,
 						spaceId: probeSpace
-					})).some((row) => row.id === created.id)) fail("a worker scoped to another tenant claimed our pending invocation");
+					})).some((row) => row.id === created.id)) fail$1("a worker scoped to another tenant claimed our pending invocation");
 					if (!(await subject.store.claimActionInvocations({
 						workerId: "iso-worker",
 						leaseDurationMs: 1e3,
 						limit: 1e3,
 						tenantId: subject.ours.tenantId,
 						spaceId: probeSpace
-					})).some((row) => row.id === created.id)) fail("a worker scoped to our own tenant did not claim our pending invocation, so the check proves nothing");
+					})).some((row) => row.id === created.id)) fail$1("a worker scoped to our own tenant did not claim our pending invocation, so the check proves nothing");
 				} finally {
 					await subject.store.updateActionInvocation(created.id, subject.ours.tenantId, probeSpace, {
 						status: "failed",
@@ -5749,7 +5753,7 @@ function tenantIsolationChecks() {
 				} catch (error) {
 					outcome = error.refusal ?? "threw";
 				}
-				if (outcome !== "not_found") fail(`a completion under another tenant's scope was ${outcome}; it must be refused as not_found`);
+				if (outcome !== "not_found") fail$1(`a completion under another tenant's scope was ${outcome}; it must be refused as not_found`);
 				let mine;
 				try {
 					await subject.host.completeExternalInvocation(ours.actionInvocationId, subject.ours.tenantId, subject.ours.spaceId, {
@@ -5761,7 +5765,7 @@ function tenantIsolationChecks() {
 				} catch (error) {
 					mine = error.refusal ?? "threw";
 				}
-				if (mine === "not_found") fail("a completion under our own scope was refused as not_found, so the check proves nothing");
+				if (mine === "not_found") fail$1("a completion under our own scope was refused as not_found, so the check proves nothing");
 				return ["completion under the other tenant's scope refused as not_found; found under ours"];
 			}
 		},
@@ -5773,11 +5777,11 @@ function tenantIsolationChecks() {
 				await subject.host.submitAction(submitInput(subject, subject.ours, "iso:projection"));
 				const ours = await subject.read(subject.ours);
 				const theirs = await subject.read(subject.theirs);
-				if (!ours.allowed) fail("our own viewer was denied the read");
-				if (ours.rows.length === 0) fail("our own viewer saw nothing, so the check proves nothing");
-				if (ours.rows.some((row) => row?.tenantId !== subject.ours.tenantId)) fail("our own viewer saw rows that are not ours, or rows carrying no tenant");
+				if (!ours.allowed) fail$1("our own viewer was denied the read");
+				if (ours.rows.length === 0) fail$1("our own viewer saw nothing, so the check proves nothing");
+				if (ours.rows.some((row) => row?.tenantId !== subject.ours.tenantId)) fail$1("our own viewer saw rows that are not ours, or rows carrying no tenant");
 				const leaked = theirs.allowed ? theirs.rows.filter((row) => row?.tenantId === subject.ours.tenantId) : [];
-				if (leaked.length > 0) fail(`a viewer in the other tenant saw ${leaked.length} of our rows`);
+				if (leaked.length > 0) fail$1(`a viewer in the other tenant saw ${leaked.length} of our rows`);
 				return [theirs.allowed ? "other tenant's viewer sees none of our rows" : "other tenant's viewer is denied"];
 			}
 		},
@@ -5794,18 +5798,18 @@ function tenantIsolationChecks() {
 					if (await subject.store.getAdapterInvocation(id, {
 						...scope,
 						tenantId: subject.theirs.tenantId
-					})) fail("an adapter invocation was readable under another tenant's scope");
-					if (await subject.store.getAdapterInvocation(id, theirs)) fail("an adapter invocation was readable under another tenant's scope");
+					})) fail$1("an adapter invocation was readable under another tenant's scope");
+					if (await subject.store.getAdapterInvocation(id, theirs)) fail$1("an adapter invocation was readable under another tenant's scope");
 					if (await subject.store.getAdapterInvocation(id, {
 						...scope,
 						spaceId: `${scope.spaceId}-other`
-					})) fail("an adapter invocation was readable under another space's scope");
+					})) fail$1("an adapter invocation was readable under another space's scope");
 					if (await subject.store.getAdapterInvocation(id, {
 						...scope,
 						actionInvocationId: `${scope.actionInvocationId}-other`
-					})) fail("an adapter invocation was readable under another action invocation's scope");
+					})) fail$1("an adapter invocation was readable under another action invocation's scope");
 					const ours = await subject.store.getAdapterInvocation(id, scope);
-					if (!ours || ours.id !== id || ours.tenantId !== scope.tenantId || ours.spaceId !== scope.spaceId || ours.actionInvocationId !== scope.actionInvocationId) fail("our own adapter invocation was not readable under our scope, so the check proves nothing");
+					if (!ours || ours.id !== id || ours.tenantId !== scope.tenantId || ours.spaceId !== scope.spaceId || ours.actionInvocationId !== scope.actionInvocationId) fail$1("our own adapter invocation was not readable under our scope, so the check proves nothing");
 				} finally {
 					await retire();
 				}
@@ -5824,7 +5828,7 @@ function tenantIsolationChecks() {
 				});
 				try {
 					const before = await subject.store.getAdapterInvocation(id, scope);
-					if (!before) fail("our own adapter invocation was not readable under our scope, so the check proves nothing");
+					if (!before) fail$1("our own adapter invocation was not readable under our scope, so the check proves nothing");
 					const untouched = shape(before);
 					for (const other of [
 						{
@@ -5859,7 +5863,7 @@ function tenantIsolationChecks() {
 								spaceId: other.spaceId,
 								condition,
 								patch: { error: "out-of-scope parent" }
-							})) fail("a settled parent update admitted another scope");
+							})) fail$1("a settled parent update admitted another scope");
 							if (await subject.store.writeAdapterInvocation({
 								scope: other,
 								condition,
@@ -5871,9 +5875,9 @@ function tenantIsolationChecks() {
 										error: "iso probe"
 									}
 								}
-							})) fail("a conditional adapter update admitted another scope");
+							})) fail$1("a conditional adapter update admitted another scope");
 							const row = await subject.store.getAdapterInvocation(id, scope);
-							if (!row) fail("our adapter row disappeared");
+							if (!row) fail$1("our adapter row disappeared");
 							if (await subject.store.writeAdapterInvocation({
 								scope: other,
 								condition,
@@ -5884,10 +5888,10 @@ function tenantIsolationChecks() {
 										id: `${id}-other`
 									}
 								}
-							})) fail("a conditional adapter create admitted another scope");
+							})) fail$1("a conditional adapter create admitted another scope");
 						}
 						const after = await subject.store.getAdapterInvocation(id, scope);
-						if (!after || shape(after) !== untouched) fail("an adapter invocation changed under another scope");
+						if (!after || shape(after) !== untouched) fail$1("an adapter invocation changed under another scope");
 					}
 					if (subject.store.writeAdapterInvocation && !await subject.store.writeAdapterInvocation({
 						scope,
@@ -5898,12 +5902,12 @@ function tenantIsolationChecks() {
 							id,
 							patch: { attempt: 2 }
 						}
-					})) fail("our conditional adapter update was refused, so the check proves nothing");
+					})) fail$1("our conditional adapter update was refused, so the check proves nothing");
 					await subject.store.updateAdapterInvocation(id, {
 						status: "succeeded",
 						updatedAt: /* @__PURE__ */ new Date()
 					}, scope);
-					if ((await subject.store.getAdapterInvocation(id, scope))?.status !== "succeeded") fail("our own adapter invocation was not updated under our scope, so the check proves nothing");
+					if ((await subject.store.getAdapterInvocation(id, scope))?.status !== "succeeded") fail$1("our own adapter invocation was not updated under our scope, so the check proves nothing");
 				} finally {
 					await retire();
 				}
@@ -5936,6 +5940,542 @@ async function runTenantIsolationChecks(subject) {
 	};
 }
 //#endregion
+//#region src/event-append-conformance.ts
+function fail(message) {
+	throw new Error(message);
+}
+function message(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function normalize(value, key) {
+	if (value == null) return void 0;
+	if (value instanceof Date) return value.getTime();
+	if (typeof value === "string") {
+		if (key === "sequence" || key === "attemptCount" || key === "leaseToken") return Number(value);
+		if ((key && [
+			"occurredAt",
+			"recordedAt",
+			"availableAt",
+			"leaseExpiresAt",
+			"createdAt",
+			"publishedAt"
+		].includes(key) || /^\d{4}-\d{2}-\d{2}(?:T|$)/.test(value)) && Number.isFinite(Date.parse(value))) return Date.parse(value);
+	}
+	if (Array.isArray(value)) return value.map((item) => normalize(item));
+	if (typeof value === "object") return Object.fromEntries(Object.entries(value).sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0).map(([name, item]) => [name, normalize(item, name)]));
+	return value;
+}
+function shape(event) {
+	return JSON.stringify(normalize(event));
+}
+function rowShape(row) {
+	return shape(row);
+}
+function keepsFirstValues(actual, first, duplicates) {
+	const record = actual;
+	const original = first;
+	const alternatives = duplicates;
+	const keys = /* @__PURE__ */ new Set([...Object.keys(first), ...duplicates.flatMap((value) => Object.keys(value))]);
+	for (const key of keys) {
+		const expected = shape(normalize(original[key], key));
+		const changed = alternatives.map((value) => shape(normalize(value[key], key))).filter((value) => value !== expected);
+		if (record[key] != null && changed.length) {
+			if (shape(normalize(record[key], key)) !== expected) return false;
+		}
+	}
+	return true;
+}
+async function append(label, run) {
+	try {
+		await run();
+	} catch (error) {
+		fail(`${label} append threw: ${message(error)}`);
+	}
+}
+async function probeRows(subject, spaceId) {
+	if (!subject.store.listOutbox) fail("store has outbox append but lacks listOutbox; cannot verify rows");
+	return (await subject.store.listOutbox({
+		tenantId: subject.tenantId,
+		spaceId
+	})).filter((row) => row.tenantId === subject.tenantId && row.spaceId === spaceId);
+}
+const leaseDurationMs = 3e4;
+function dueTime() {
+	return /* @__PURE__ */ new Date(Math.floor(Date.now() / 1e3) * 1e3 - 5e3);
+}
+const relayInterference = "another worker claimed the probe outbox row; pause outbox relays for the probe tenant";
+function checkWorker(row, workerId) {
+	if (row.leaseOwner && row.leaseOwner !== workerId) fail(relayInterference);
+}
+const clockSkewMs = 5e3;
+function leaseExpiry(row) {
+	return row.leaseExpiresAt == null ? void 0 : Number(normalize(row.leaseExpiresAt, "leaseExpiresAt"));
+}
+async function waitForLeaseExpiry(row) {
+	const expiry = leaseExpiry(row);
+	if (expiry !== void 0 && expiry > Date.now()) await new Promise((resolve) => setTimeout(resolve, expiry - Date.now() + 100));
+}
+function checkState(row, state, workerId) {
+	checkWorker(row, workerId);
+	const expiry = leaseExpiry(row);
+	if (state === "retry-pending" && expiry !== void 0 && expiry > Date.now() + clockSkewMs) fail("markOutboxFailed did not release the lease");
+	if (row.status !== (state === "published" ? "published" : "pending")) fail(relayInterference);
+	if (state === "leased" && row.leaseOwner !== workerId) fail(relayInterference);
+}
+function leaseToken(row) {
+	return row.leaseToken == null ? void 0 : Number(row.leaseToken);
+}
+async function claimProbeRows(subject, scope, pendingCount) {
+	if (scope.run.filterViolation) fail("outbox check skipped because of the earlier claimOutbox filter violation");
+	const rows = await subject.store.claimOutbox({
+		tenantId: subject.tenantId,
+		spaceId: scope.spaceId,
+		now: /* @__PURE__ */ new Date(),
+		workerId: scope.workerId,
+		leaseDurationMs,
+		limit: pendingCount
+	});
+	const foreign = rows.filter((row) => row.tenantId !== subject.tenantId || row.spaceId !== scope.spaceId);
+	const own = rows.filter((row) => row.tenantId === subject.tenantId && row.spaceId === scope.spaceId);
+	for (const row of own) scope.leaseTokens.set(row.id, leaseToken(row));
+	if (foreign.length) {
+		scope.run.filterViolation = true;
+		scope.violatingClaimRows = own;
+		fail(`claimOutbox ignored the tenant/space filter; foreign row IDs: ${foreign.map((row) => row.id).join(", ")}; their leases lapse within ${leaseDurationMs}ms of the claim if the store honours leaseDurationMs; the checks write nothing to foreign rows; further claims skipped for this run after filter violation`);
+	}
+	return rows;
+}
+async function retireAfterFilterViolation(subject, scope) {
+	const errors = [];
+	for (const row of scope.violatingClaimRows) try {
+		checkState(row, "leased", scope.workerId);
+		await subject.store.markOutboxFailed({
+			id: row.id,
+			workerId: scope.workerId,
+			leaseToken: scope.leaseTokens.get(row.id),
+			deadLetter: true,
+			error: "event append probe; never published",
+			availableAt: dueTime()
+		});
+	} catch (error) {
+		errors.push(`probe row retirement failed (${row.id}): ${message(error)}`);
+	}
+	const pending = (await probeRows(subject, scope.spaceId)).filter((row) => row.status === "pending");
+	if (pending.length) errors.push(`probe rows still pending after filter violation: ${pending.map((row) => row.id).join(", ")}; dead-letter them by hand`);
+	if (errors.length) fail(errors.join("; "));
+}
+async function retire(subject, scope) {
+	const { store } = subject;
+	if (!store.listOutbox) return;
+	if (scope.run.filterViolation) {
+		try {
+			await retireAfterFilterViolation(subject, scope);
+		} catch (error) {
+			fail(`probe rows could not be retired: ${message(error)}`);
+		}
+		return;
+	}
+	let failure;
+	try {
+		let pending = (await probeRows(subject, scope.spaceId)).filter((row) => row.status === "pending");
+		while (pending.length) {
+			if (!store.claimOutbox || !store.markOutboxFailed) fail("missing claimOutbox/markOutboxFailed");
+			for (const row of pending) checkWorker(row, scope.workerId);
+			const owned = pending.filter((row) => row.leaseOwner === scope.workerId);
+			const claimed = owned.length ? owned : await claimProbeRows(subject, scope, pending.length);
+			if (!claimed.length) {
+				for (const row of await probeRows(subject, scope.spaceId)) checkState(row, "pending", scope.workerId);
+				fail("claimOutbox returned no rows for pending probe outbox rows");
+			}
+			const errors = [];
+			for (const row of claimed) {
+				checkState(row, "leased", scope.workerId);
+				try {
+					await store.markOutboxFailed({
+						id: row.id,
+						workerId: scope.workerId,
+						leaseToken: scope.leaseTokens.get(row.id),
+						deadLetter: true,
+						error: "event append probe; never published",
+						availableAt: dueTime()
+					});
+				} catch (error) {
+					errors.push(`probe row retirement failed: ${message(error)}`);
+				}
+			}
+			if (errors.length) fail(errors.join("; "));
+			const retired = await probeRows(subject, scope.spaceId);
+			const remaining = retired.filter((row) => row.status === "pending");
+			if (remaining.length >= pending.length) fail("retirement made no progress");
+			for (const row of claimed) if (retired.find((candidate) => candidate.id === row.id)?.status !== "dead_letter") fail(`retirement did not leave the probe outbox row in dead_letter: ${row.id}`);
+			pending = remaining;
+		}
+	} catch (error) {
+		failure = message(error);
+	}
+	if (scope.run.filterViolation) try {
+		await retireAfterFilterViolation(subject, scope);
+	} catch (error) {
+		failure = [failure, message(error)].filter(Boolean).join("; ");
+	}
+	if (failure) fail(`probe rows could not be retired: ${failure}`);
+}
+function requireOutboxVerification(store) {
+	for (const key of [
+		"listOutbox",
+		"claimOutbox",
+		"markOutboxPublished",
+		"markOutboxFailed"
+	]) if (!store[key]) fail(`store has outbox append but lacks ${key}; cannot verify or clean up probe rows`);
+}
+async function probe(subject, mode, run = { filterViolation: false }) {
+	const { store, tenantId } = subject;
+	const transactional = mode.startsWith("transaction");
+	const afterPlain = mode === "after-plain" || mode === "transaction-after-plain";
+	const outbox = mode === "outbox" || mode === "transaction-outbox" || afterPlain;
+	if (transactional && !store.transactionWithEvents) return ["skipped: store has no transactionWithEvents"];
+	if (!transactional && outbox && !store.appendEventWithOutbox) return ["skipped: store has no appendEventWithOutbox"];
+	if (outbox && run.filterViolation) fail("outbox check skipped because of the earlier claimOutbox filter violation");
+	await subject.reset?.();
+	const spaceId = `event-append-probe-${globalThis.crypto.randomUUID()}`;
+	const scope = {
+		spaceId,
+		workerId: `event-append-probe-${globalThis.crypto.randomUUID()}`,
+		run,
+		leaseTokens: /* @__PURE__ */ new Map(),
+		violatingClaimRows: []
+	};
+	const recordedAt = dueTime();
+	const first = {
+		id: globalThis.crypto.randomUUID(),
+		tenantId,
+		spaceId,
+		eventType: "EventAppendProbe",
+		eventSchemaVersion: 1,
+		subjectType: "EventAppendProbe",
+		subjectId: "first",
+		actorId: "event-append-probe",
+		actorType: "system",
+		actionInvocationId: globalThis.crypto.randomUUID(),
+		correlationId: globalThis.crypto.randomUUID(),
+		causationId: globalThis.crypto.randomUUID(),
+		payload: {
+			probe: "first",
+			nested: {
+				b: 2,
+				a: 1
+			}
+		},
+		sequence: 50,
+		occurredAt: /* @__PURE__ */ new Date(recordedAt.getTime() - 1e3),
+		recordedAt,
+		provenance: {
+			source: "system",
+			auditAttributes: { "probe.origin": "first" }
+		}
+	};
+	const metadata = {
+		producerModuleVersion: "event-append-probe@1",
+		payloadClassification: "internal",
+		traceContext: { traceparent: "first" },
+		includeProvenance: false,
+		includeActor: false
+	};
+	const duplicates = ["later", "earlier"].map((direction, index) => ({
+		direction,
+		event: {
+			...first,
+			eventType: `${direction}EventAppendProbe`,
+			eventSchemaVersion: index + 2,
+			subjectType: `${direction}Probe`,
+			subjectId: direction,
+			actorId: `${direction}-actor`,
+			actorType: "service_account",
+			actionInvocationId: globalThis.crypto.randomUUID(),
+			correlationId: globalThis.crypto.randomUUID(),
+			causationId: globalThis.crypto.randomUUID(),
+			payload: {
+				probe: direction,
+				[direction]: true
+			},
+			sequence: index === 0 ? 99 : 1,
+			occurredAt: new Date(first.occurredAt.getTime() + (index === 0 ? 2e3 : -2e3)),
+			recordedAt: new Date(recordedAt.getTime() + (index === 0 ? 2e3 : -2e3)),
+			provenance: {
+				source: "api",
+				auditAttributes: {
+					"probe.origin": direction,
+					[`probe.${direction}`]: "added"
+				}
+			},
+			consistency: "provisional-until-reconciled"
+		},
+		metadata: {
+			producerModuleVersion: `event-append-probe@${index + 2}`,
+			payloadClassification: "confidential",
+			traceContext: {
+				traceparent: direction,
+				[direction]: "added"
+			},
+			includeProvenance: true,
+			includeActor: true
+		}
+	}));
+	const firstInput = structuredClone(first);
+	const outboxInput = structuredClone({
+		...first,
+		...metadata
+	});
+	const duplicateInputs = structuredClone(duplicates);
+	let original;
+	const verifyEvents = (events, context = "") => {
+		events = events.filter((event) => event.id === firstInput.id);
+		if (events.length === 0) fail("store kept no event, so the check proves nothing" + context);
+		if (events.length !== 1) fail(`store kept ${events.length === 2 ? "two" : events.length} events instead of one` + context);
+		const event = events[0];
+		if (!keepsFirstValues(event, firstInput, duplicateInputs.map((value) => value.event)) || original !== void 0 && shape(event) !== original) fail("store kept the later event or changed the first event" + context);
+		original ??= shape(event);
+	};
+	const verify = async (state) => {
+		const context = state ? ` on duplicate append against the ${state} outbox row` : "";
+		verifyEvents(await store.listEvents(tenantId, spaceId), context);
+		if (!outbox) return void 0;
+		const rows = await probeRows(subject, spaceId);
+		if (afterPlain) {
+			if (rows.length) fail("store added an outbox row for an already-stored event");
+			return;
+		}
+		if (rows.length === 0) fail(state ? `store removed the existing outbox row on duplicate append (${state})` : "store added no outbox row, so the check proves nothing");
+		if (rows.length !== 1) fail(`store added a second outbox row (${rows.length} rows)` + context);
+		return rows[0];
+	};
+	let controlSequence = 100;
+	const duplicate = async (afterEach) => {
+		for (const { event, metadata, direction } of duplicates) {
+			if (transactional) {
+				const controlId = globalThis.crypto.randomUUID();
+				const control = {
+					...firstInput,
+					id: controlId,
+					sequence: controlSequence++,
+					payload: { probe: "transaction-control" }
+				};
+				await store.transactionWithEvents(async (tx) => {
+					await append("committed duplicate transaction", () => outbox ? tx.appendEventWithOutbox(event, metadata) : tx.appendEvent(event));
+					await append("committed duplicate transaction control", () => tx.appendEvent(control));
+				});
+				if (!(await store.listEvents(tenantId, spaceId)).some((event) => event.id === controlId)) fail(`committed duplicate transaction lost its control event: ${controlId}`);
+			} else await append(direction, () => outbox ? store.appendEventWithOutbox(event, metadata) : store.appendEvent(event));
+			await afterEach();
+		}
+	};
+	let failure;
+	try {
+		if (transactional) {
+			if (!await store.transactionWithEvents(async (tx) => {
+				if (outbox && !tx.appendEventWithOutbox) return false;
+				if (outbox) requireOutboxVerification(store);
+				await append("first transaction", () => outbox && !afterPlain ? tx.appendEventWithOutbox(first, metadata) : tx.appendEvent(first));
+				for (const { event, metadata, direction } of duplicates) await append(`${direction} transaction`, () => outbox ? tx.appendEventWithOutbox(event, metadata) : tx.appendEvent(event));
+				return true;
+			})) return ["skipped: transaction has no appendEventWithOutbox"];
+		} else {
+			if (outbox) requireOutboxVerification(store);
+			await append("first", () => mode === "outbox" ? store.appendEventWithOutbox(first, metadata) : store.appendEvent(first));
+		}
+		if (outbox && !afterPlain) {
+			let row = await verify();
+			checkState(row, "pending", scope.workerId);
+			if (row.event.producerModuleVersion !== metadata.producerModuleVersion) fail("store changed the first pending outbox producerModuleVersion metadata");
+			if (row.event.payloadClassification !== metadata.payloadClassification) fail("store changed the first pending outbox payloadClassification metadata");
+			if (row.actorDisclosure === "included") fail("store included actor disclosure although first metadata did not opt in with includeActor");
+			if (row.event.actorId != null || row.event.actorType != null) fail("store put actorId or actorType on the outbox envelope although first metadata did not opt in with includeActor");
+			if (!keepsFirstValues(row.event, outboxInput, duplicateInputs.map((value) => ({
+				...value.event,
+				...value.metadata
+			})))) fail("store changed the first pending outbox envelope");
+			for (const state of [
+				"pending",
+				"leased",
+				"retry-pending",
+				"published"
+			]) {
+				row = await verify();
+				checkState(row, state, scope.workerId);
+				const snapshot = rowShape(row);
+				await duplicate(async () => {
+					row = await verify(state);
+					if (rowShape(row) !== snapshot) fail(`store changed the existing ${state} outbox row on duplicate append (including delivery state, envelope and metadata)` + (row.leaseOwner && row.leaseOwner !== scope.workerId || row.status !== (state === "published" ? "published" : "pending") ? `; ${relayInterference}` : ""));
+				});
+				if (state === "pending" || state === "retry-pending") {
+					checkState(row, state, scope.workerId);
+					if (state === "retry-pending") await waitForLeaseExpiry(row);
+					const claimed = await claimProbeRows(subject, scope, 1);
+					row = await verify();
+					checkWorker(row, scope.workerId);
+					if (row.status !== "pending") fail(relayInterference);
+					if (claimed.length !== 1 || claimed[0].id !== row.id || row.leaseOwner !== scope.workerId) fail("claimOutbox did not lease the pending probe outbox row");
+					if (state === "retry-pending") {
+						row = await verify();
+						checkState(row, "leased", scope.workerId);
+						await store.markOutboxPublished(row.id, scope.workerId, /* @__PURE__ */ new Date(), scope.leaseTokens.get(row.id));
+						row = await verify();
+						checkWorker(row, scope.workerId);
+						if (row.status !== "published") fail("markOutboxPublished did not settle the probe outbox row as published");
+					}
+				} else if (state === "leased") {
+					row = await verify();
+					checkState(row, "leased", scope.workerId);
+					await store.markOutboxFailed({
+						id: row.id,
+						workerId: scope.workerId,
+						leaseToken: scope.leaseTokens.get(row.id),
+						deadLetter: false,
+						availableAt: dueTime(),
+						error: "event append probe; retry"
+					});
+					row = await verify();
+					checkState(row, "retry-pending", scope.workerId);
+				}
+			}
+		} else {
+			await verify();
+			await duplicate(async () => {
+				await verify();
+			});
+			if (afterPlain) {
+				const control = {
+					...first,
+					id: globalThis.crypto.randomUUID(),
+					sequence: 51,
+					payload: { probe: "control" }
+				};
+				if (transactional) await store.transactionWithEvents((tx) => append("control transaction", () => tx.appendEventWithOutbox(control, metadata)));
+				else await append("control", () => store.appendEventWithOutbox(control, metadata));
+				const rows = await probeRows(subject, spaceId);
+				if (rows.length !== 1 || rows[0].event.eventId !== control.id) fail("store did not expose exactly the control event's outbox row; absence verification proves nothing");
+				checkState(rows[0], "pending", scope.workerId);
+			}
+		}
+	} catch (error) {
+		failure = message(error);
+	} finally {
+		if (outbox) try {
+			await retire(subject, scope);
+		} catch (error) {
+			failure = [failure, message(error)].filter(Boolean).join("; ");
+		}
+		if (failure) fail(failure);
+	}
+	return ["earlier and later duplicate appends kept one first event" + (outbox ? afterPlain ? " and added no outbox row, verified by a fresh control row" : " and preserved pending, leased, retry-pending and published outbox rows and first metadata" : "")];
+}
+/**
+* Six checks detecting common first-write-wins violations through plain,
+* outbox and transaction appends, including outbox-after-plain and committed
+* duplicates: throwing, replacing, merging, keeping both events, selecting the
+* earlier-ordered or later-ordered duplicate, adding outbox rows, and resetting
+* or rewriting existing outbox rows in the probed states. They are not exhaustive.
+* Duplicates have both earlier and later ordering fields and vary the remaining
+* envelope and outbox metadata fields. Whole-record snapshots compare duplicates
+* while pending, leased by the probe, retry-pending, and settled as published.
+* Retry-pending accepts a cleared or expired lease, the probe owner retained
+* without an expiry, or an expiry within five seconds of the probe's clock,
+* which is waited out before the row is claimed again; attempt counts and
+* error formatting are not prescribed.
+* Initial comparisons accept store-specific fields and fields the store omits
+* or returns as null; transaction verification runs after commit without requiring
+* read-your-writes. Each committed duplicate transaction also appends a fresh plain
+* control event whose presence is verified after commit.
+* Successful outbox-creating checks leave the probe row
+* published although nothing was sent; its event-append-probe space identifies
+* it. Absence checks write a control row that cleanup dead-letters. These rows can
+* be requeued by operator tooling; exclude probe spaces from real publication.
+*
+* Intended for test or staging stores with outbox relays paused for the probe
+* tenant. Event and availability inputs use whole seconds a few seconds in the
+* past; claims and publication markers use real current time. Checks leave
+* append-only events in fresh event-append-probe spaces. Final cleanup
+* attempts to dead-letter visible probe rows still pending with
+* "event append probe; never published".
+* Claims use real current time, a pending-probe-row limit, and a 30-second lease.
+* A filter-ignoring claim can lease foreign rows and make whatever writes the
+* claim itself makes (such as incrementing attempts). Checks write nothing to
+* foreign rows and stop claiming for that run (or that standalone check).
+* After a filter violation, cleanup can dead-letter only probe rows returned by
+* that claim, using the probe worker and claim tokens without further claims.
+* Failures list visible probe rows still pending and instruct manual dead-lettering.
+* Later outbox checks in the run fail as skipped because of the earlier filter
+* violation. Leases lapse within 30 seconds
+* of the claim if the store honours the lease duration.
+*
+* Missing append capabilities skip; missing listOutbox, claimOutbox,
+* markOutboxPublished or markOutboxFailed fails verification/cleanup.
+* Known limits: rules comparing ordering fields in mixed directions, store-wide
+* uniqueness across spaces or tenants, the dead-letter state, claims that
+* lease foreign rows without returning them, buffered merges into fields the
+* store never returns, and duplicate handling that only holds within one
+* process. Stores requiring gapless sequences, or unique keys over fields the
+* control events share with the probe event, can fail falsely.
+*/
+function eventAppendChecks() {
+	return checksForRun();
+}
+function checksForRun(run) {
+	return [
+		{
+			id: "fabric.store.event-append-first-write-wins.v1",
+			run: (subject) => probe(subject, "plain", run)
+		},
+		{
+			id: "fabric.store.event-append-outbox-first-write-wins.v1",
+			run: (subject) => probe(subject, "outbox", run)
+		},
+		{
+			id: "fabric.store.event-append-outbox-after-plain.v1",
+			run: (subject) => probe(subject, "after-plain", run)
+		},
+		{
+			id: "fabric.store.event-append-transaction-first-write-wins.v1",
+			run: (subject) => probe(subject, "transaction", run)
+		},
+		{
+			id: "fabric.store.event-append-transaction-outbox-first-write-wins.v1",
+			run: (subject) => probe(subject, "transaction-outbox", run)
+		},
+		{
+			id: "fabric.store.event-append-transaction-outbox-after-plain.v1",
+			run: (subject) => probe(subject, "transaction-after-plain", run)
+		}
+	];
+}
+/**
+* Run eventAppendChecks and collect results instead of stopping at the first
+* failure. Use test or staging stores with relays paused for the probe tenant;
+* see eventAppendChecks for probe publication markers and cleanup side effects.
+*/
+async function runEventAppendChecks(subject) {
+	const checks = [];
+	for (const check of checksForRun({ filterViolation: false })) try {
+		const evidence = await check.run(subject);
+		checks.push({
+			id: check.id,
+			status: evidence[0]?.startsWith("skipped: ") ? "skipped" : "passed",
+			evidence
+		});
+	} catch (error) {
+		checks.push({
+			id: check.id,
+			status: "failed",
+			evidence: [],
+			error: message(error)
+		});
+	}
+	return {
+		passed: checks.every((check) => check.status !== "failed"),
+		checks
+	};
+}
+//#endregion
 exports.ActionAdmissionError = ActionAdmissionError;
 exports.ExternalCompletionError = ExternalCompletionError;
 exports.IdempotencyConflictError = IdempotencyConflictError;
@@ -5958,8 +6498,10 @@ exports.createGovernedActionHost = createGovernedActionHost;
 exports.createStoreBackedActionDispatcher = createStoreBackedActionDispatcher;
 exports.digestParameters = digestParameters;
 exports.emitPlatformHostTelemetry = emitPlatformHostTelemetry;
+exports.eventAppendChecks = eventAppendChecks;
 exports.getPlatformHostHealthSnapshot = getPlatformHostHealthSnapshot;
 exports.outboxActorDisclosure = outboxActorDisclosure;
+exports.runEventAppendChecks = runEventAppendChecks;
 exports.runOutboxRelayCycle = runOutboxRelayCycle;
 exports.runPlatformActionWorker = runPlatformActionWorker;
 exports.runPlatformActionWorkerCycle = runPlatformActionWorkerCycle;