@fabricorg/platform-host 8.9.0 → 8.10.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @fabricorg/platform-host
 
+## 8.10.0
+
+### Minor Changes
+
+- 6147d14: Add read-only, principal-scoped historical submission receipts without rerunning submission checks. Preserve submission ordering, hide receipts belonging to other principals, and expose erased records without refusal evidence.
+
+  Store conformance checks verify each receipt field and report skipped optional refusal and erasure probes. Normalize absent PostgreSQL refusal metadata to `undefined` in the receipt projection.
+
+### Patch Changes
+
+- fbbc664: Treat an empty authorization binding id as absent for submission idempotency identity and receipt ownership. Normalize new submissions and match stored empty binding ids from older Hosts, including recorded refusals, while preserving conflicts with non-empty binding ids.
+
 ## 8.9.0
 
 ### Minor Changes

package/README.md

@@ -255,7 +255,9 @@ recovery within `recoveryMaxAttempts`. A handler error without eligible confirme
 not an automatic retry or a claim that the current transaction committed.
 
 New rows bind that key to the action version, actor/authority binding, and a versioned canonical
-parameter digest. Host 3 defaults to `enforce`, which throws `IdempotencyConflictError`; configure
+parameter digest. An empty `authorizationBindingId` is treated as absent for submission
+idempotency identity and receipt ownership, including stored empty IDs from older Hosts.
+Host 3 defaults to `enforce`, which throws `IdempotencyConflictError`; configure
 `idempotency.conflictMode` as `audit-only` for a preflight soak. Legacy null-digest rows skip only the
 parameter comparison and call `onLegacyRecord`; actor, authority-binding, and action-version mismatches
 still reject in enforce mode. See `MIGRATION-2-IDEMPOTENCY.md`.
@@ -1348,7 +1350,7 @@ these rows inert. The stored-record erasure operator can redact their payload fi
 Host does not schedule automatic retention. See **Erasing stored records**.
 
 Entitlement, authorization and admission checks still run on replay before Host tries an insert;
-there is no refusal lookup before the checks. A matching caller receives the stored refusal,
+there is no refusal lookup before the checks (use the separate `readSubmissionOutcome` receipt read below). A matching caller receives the stored refusal,
 including after the checks start passing. Identity compares actor id and type, authorization
 binding id, action version, and a parameter digest when the stored refusal has one. A refused
 caller with a different identity receives its own unrecorded refusal. An admitted caller with a
@@ -1403,6 +1405,25 @@ submitted …"). Before submitting an action that declares `admitSubmission`: (1
 migration 6, and nothing is written; (2) upgrade every worker, since a worker on an older Host would
 execute such an invocation without checking `admittedAt`.
 
+### Read a historical submission receipt
+
+`host.readSubmissionOutcome({ tenantId, spaceId, actionId, idempotencyKey, actorId,
+actorType, authorizationBindingId })` reads receipt metadata without rerunning mutation
+permission or admission checks. The embedding application must supply trusted, authenticated
+tenant, space and actor identity. The original principal can read its receipt after mutation
+permission is revoked. The key is exact, including the valid empty string.
+
+A refusal error with `recorded: false` establishes nothing about key ownership: an admitted
+invocation or another principal's record may hold it. Use the receipt read to observe a
+visible durable outcome. `no_record` means no record visible to this principal at this
+snapshot; it does not establish that the key is free. A returned invocation status is an
+observation and may change. Refused receipts include only their validated descriptor;
+erased receipts include only identity, version and recorded status. No pending work is dispatched.
+
+The operation is available independently of refusal recording and conflict mode. Custom
+stores implement optional `getSubmissionOutcomeByKey`; an unsupported store throws
+`SubmissionOutcomeUnsupportedError`. Storage errors propagate. See ADR 0022.
+
 ## External mutation governance
 
 Hosts can configure `resolveMutationGovernance` to persist an approved, provider-neutral

package/dist/index.cjs

@@ -4,6 +4,201 @@ let _fabricorg_platform = require("@fabricorg/platform");
 let perf_hooks = require("perf_hooks");
 let _fabricorg_assembly = require("@fabricorg/assembly");
 let crypto = require("crypto");
+//#region src/erasure-types.ts
+const HOST_RECORDS_ERASED_EVENT = "HostRecordsErased";
+/** Sentinel replacing required payload digests after stored-record erasure. */
+const ERASED_DIGEST = "erased";
+//#endregion
+//#region src/types.ts
+/** Durable Host lifecycle generation, independent from the npm package version. */
+const PLATFORM_HOST_CONTRACT_VERSION = 2;
+var IdempotencyConflictError = class extends Error {
+	conflict;
+	code = "IDEMPOTENCY_CONFLICT";
+	constructor(conflict) {
+		super(`Idempotency key "${conflict.idempotencyKey}" conflicts with invocation ${conflict.existingInvocationId}: ${conflict.reasons.join(", ")}`);
+		this.conflict = conflict;
+		this.name = "IdempotencyConflictError";
+	}
+};
+/**
+* Thrown by `submitAction` when a declared admission check did not admit the
+* submission. By default Host writes nothing for it. With recordRefusals
+* enabled and an idempotency key, a definitive refusal can be recorded;
+* `recorded` confirms persistence of the terminal refusal. The message holds
+* the action id, the refusal and, for `refused`, the check's fixed code. It omits parameter
+* payloads and caught callback error text.
+*/
+var ActionAdmissionError = class extends Error {
+	actionId;
+	refusal;
+	refusalCode;
+	recorded;
+	code = "ACTION_ADMISSION_REFUSED";
+	constructor(actionId, refusal, refusalCode, recorded = false) {
+		super(`Action ${actionId} submission was not admitted (${refusal}${refusalCode ? `: ${refusalCode}` : ""}); ${recorded ? "the refusal was recorded under the idempotency key" : "nothing was recorded"}.`);
+		this.actionId = actionId;
+		this.refusal = refusal;
+		this.refusalCode = refusalCode;
+		this.recorded = recorded;
+		this.name = "ActionAdmissionError";
+	}
+};
+/** A definitive authorization-boundary refusal before an invocation is created. */
+var SubmissionRefusalError = class extends Error {
+	actionId;
+	refusal;
+	recorded;
+	code = "ACTION_SUBMISSION_REFUSED";
+	constructor(actionId, refusal, message, recorded = false) {
+		super(recorded ? `Action ${actionId} submission was refused (${refusal}); the refusal was recorded under the idempotency key.` : message);
+		this.actionId = actionId;
+		this.refusal = refusal;
+		this.recorded = recorded;
+		this.name = "SubmissionRefusalError";
+	}
+};
+/**
+* Why a completion was not applied, typed so a webhook handler can answer
+* the external system correctly: `retryable` means the invocation is still
+* being finalized and the same callback will be accepted once it parks, so
+* answer with something the sender retries; anything else is permanent and
+* a retry will get the same refusal without a configuration/input change.
+* `redaction_failed` means completion result or error-text redaction failed before writes;
+* it is not retryable.
+*/
+var ExternalCompletionError = class extends Error {
+	refusal;
+	code = "EXTERNAL_COMPLETION_REFUSED";
+	constructor(refusal, message) {
+		super(message);
+		this.refusal = refusal;
+		this.name = "ExternalCompletionError";
+	}
+	get retryable() {
+		return this.refusal === "still_executing";
+	}
+};
+/** Maximum serialized UTF-8 evidence size. */
+const MAX_APPROVAL_EVIDENCE_BYTES = 16384;
+const APPROVAL_REQUESTED_EVENT = "ApprovalRequested";
+const APPROVAL_DECIDED_EVENT = "ApprovalDecided";
+const APPROVAL_EXPIRED_EVENT = "ApprovalExpired";
+const APPROVAL_DECISION_REFUSED_EVENT = "ApprovalDecisionRefused";
+//#endregion
+//#region src/submission-refusal.ts
+/** Validate and copy only the descriptor's declared fields, on both sides of storage. */
+function submissionRefusalDescriptor(value) {
+	if (!value || typeof value !== "object") throw new Error("Invalid submission refusal descriptor.");
+	const fields = Object.getOwnPropertyDescriptors(value);
+	const data = (key) => fields[key]?.value;
+	const kind = data("class");
+	const keys = Reflect.ownKeys(value);
+	if ((kind === "entitlement" || kind === "authorization") && keys.length === 1) return { class: kind };
+	if (kind === "admission" && keys.every((key) => key === "class" || key === "refusal" || key === "refusalCode")) {
+		const refusal = data("refusal");
+		const code = data("refusalCode");
+		if (refusal === "invalid_parameters" && !Object.hasOwn(fields, "refusalCode")) return {
+			class: kind,
+			refusal
+		};
+		if (refusal === "refused" && (!Object.hasOwn(fields, "refusalCode") || typeof code === "string" && /^[a-z][A-Za-z0-9_.:-]{0,127}$/.test(code))) return {
+			class: kind,
+			refusal,
+			...code === void 0 ? {} : { refusalCode: code }
+		};
+	}
+	throw new Error("Invalid submission refusal descriptor.");
+}
+function validateRefusalRecord(record) {
+	if (record?.status === "submission_refused") submissionRefusalDescriptor(record.submissionRefusal);
+	return record;
+}
+/** Reconstruct errors from fixed validated evidence, without row error text or parameters. */
+function recordedSubmissionRefusal(record) {
+	const descriptor = submissionRefusalDescriptor(record.submissionRefusal);
+	return descriptor.class === "admission" ? new ActionAdmissionError(record.actionId, descriptor.refusal, descriptor.refusalCode, true) : new SubmissionRefusalError(record.actionId, descriptor.class, "", true);
+}
+/** Refusals enter the ledger through the narrow insert, rather than generic status writes. */
+function assertInvocationWriteStatus(status) {
+	if (status === "submission_refused") throw new Error("submission_refused can only be inserted by recordSubmissionRefusal.");
+}
+//#endregion
+//#region src/submission-outcome.ts
+var SubmissionOutcomeUnsupportedError = class extends Error {
+	constructor() {
+		super("Store lacks getSubmissionOutcomeByKey.");
+		this.name = "SubmissionOutcomeUnsupportedError";
+	}
+};
+/** Copy receipt fields only, without exposing execution data. */
+function submissionOutcomeProjection(row) {
+	return structuredClone({
+		tenantId: row.tenantId,
+		spaceId: row.spaceId,
+		actionId: row.actionId,
+		idempotencyKey: row.idempotencyKey,
+		id: row.id,
+		actionVersion: row.actionVersion,
+		actorId: row.actorId,
+		actorType: row.actorType,
+		authorizationBindingId: row.authorizationBindingId,
+		idempotencyActorId: row.idempotencyActorId,
+		idempotencyAuthorizationBindingId: row.idempotencyAuthorizationBindingId,
+		status: row.status,
+		submissionRefusal: row.submissionRefusal,
+		storedRecordsErased: row.storedRecordsErased
+	});
+}
+function createSubmissionOutcomeReader(store) {
+	return { async readSubmissionOutcome(input) {
+		const snapshot = {
+			tenantId: input.tenantId,
+			spaceId: input.spaceId,
+			actionId: input.actionId,
+			idempotencyKey: input.idempotencyKey,
+			actorId: input.actorId,
+			actorType: input.actorType,
+			authorizationBindingId: input.authorizationBindingId
+		};
+		for (const field of [
+			"tenantId",
+			"spaceId",
+			"actionId",
+			"idempotencyKey",
+			"actorId",
+			"actorType"
+		]) if (typeof snapshot[field] !== "string") throw new TypeError(`Invalid ${field}.`);
+		if (!store.getSubmissionOutcomeByKey) throw new SubmissionOutcomeUnsupportedError();
+		const row = await store.getSubmissionOutcomeByKey({
+			tenantId: snapshot.tenantId,
+			spaceId: snapshot.spaceId,
+			actionId: snapshot.actionId,
+			idempotencyKey: snapshot.idempotencyKey
+		});
+		if (!row || (row.idempotencyActorId ?? row.actorId) !== snapshot.actorId || row.actorType !== snapshot.actorType || ((row.idempotencyAuthorizationBindingId ?? row.authorizationBindingId) || void 0) !== (snapshot.authorizationBindingId || void 0)) return { kind: "no_record" };
+		const identity = {
+			actionInvocationId: row.id,
+			actionVersion: row.actionVersion
+		};
+		if (row.storedRecordsErased) return {
+			...identity,
+			kind: "records_erased",
+			recordedStatus: row.status
+		};
+		if (row.status === "submission_refused") return {
+			...identity,
+			kind: "submission_refused",
+			submissionRefusal: submissionRefusalDescriptor(row.submissionRefusal)
+		};
+		return {
+			...identity,
+			kind: "invocation",
+			status: row.status
+		};
+	} };
+}
+//#endregion
 //#region src/transaction-rollback.ts
 /** Evidence from a transaction provider that rollback completed successfully. */
 var ConfirmedTransactionRollback = class extends Error {
@@ -182,126 +377,6 @@ function createStoredRecordErasureHost(store, authorization) {
 	} };
 }
 //#endregion
-//#region src/erasure-types.ts
-const HOST_RECORDS_ERASED_EVENT = "HostRecordsErased";
-/** Sentinel replacing required payload digests after stored-record erasure. */
-const ERASED_DIGEST = "erased";
-//#endregion
-//#region src/types.ts
-/** Durable Host lifecycle generation, independent from the npm package version. */
-const PLATFORM_HOST_CONTRACT_VERSION = 2;
-var IdempotencyConflictError = class extends Error {
-	conflict;
-	code = "IDEMPOTENCY_CONFLICT";
-	constructor(conflict) {
-		super(`Idempotency key "${conflict.idempotencyKey}" conflicts with invocation ${conflict.existingInvocationId}: ${conflict.reasons.join(", ")}`);
-		this.conflict = conflict;
-		this.name = "IdempotencyConflictError";
-	}
-};
-/**
-* Thrown by `submitAction` when a declared admission check did not admit the
-* submission. By default Host writes nothing for it. With recordRefusals
-* enabled and an idempotency key, a definitive refusal can be recorded;
-* `recorded` confirms persistence of the terminal refusal. The message holds
-* the action id, the refusal and, for `refused`, the check's fixed code. It omits parameter
-* payloads and caught callback error text.
-*/
-var ActionAdmissionError = class extends Error {
-	actionId;
-	refusal;
-	refusalCode;
-	recorded;
-	code = "ACTION_ADMISSION_REFUSED";
-	constructor(actionId, refusal, refusalCode, recorded = false) {
-		super(`Action ${actionId} submission was not admitted (${refusal}${refusalCode ? `: ${refusalCode}` : ""}); ${recorded ? "the refusal was recorded under the idempotency key" : "nothing was recorded"}.`);
-		this.actionId = actionId;
-		this.refusal = refusal;
-		this.refusalCode = refusalCode;
-		this.recorded = recorded;
-		this.name = "ActionAdmissionError";
-	}
-};
-/** A definitive authorization-boundary refusal before an invocation is created. */
-var SubmissionRefusalError = class extends Error {
-	actionId;
-	refusal;
-	recorded;
-	code = "ACTION_SUBMISSION_REFUSED";
-	constructor(actionId, refusal, message, recorded = false) {
-		super(recorded ? `Action ${actionId} submission was refused (${refusal}); the refusal was recorded under the idempotency key.` : message);
-		this.actionId = actionId;
-		this.refusal = refusal;
-		this.recorded = recorded;
-		this.name = "SubmissionRefusalError";
-	}
-};
-/**
-* Why a completion was not applied, typed so a webhook handler can answer
-* the external system correctly: `retryable` means the invocation is still
-* being finalized and the same callback will be accepted once it parks, so
-* answer with something the sender retries; anything else is permanent and
-* a retry will get the same refusal without a configuration/input change.
-* `redaction_failed` means completion result or error-text redaction failed before writes;
-* it is not retryable.
-*/
-var ExternalCompletionError = class extends Error {
-	refusal;
-	code = "EXTERNAL_COMPLETION_REFUSED";
-	constructor(refusal, message) {
-		super(message);
-		this.refusal = refusal;
-		this.name = "ExternalCompletionError";
-	}
-	get retryable() {
-		return this.refusal === "still_executing";
-	}
-};
-/** Maximum serialized UTF-8 evidence size. */
-const MAX_APPROVAL_EVIDENCE_BYTES = 16384;
-const APPROVAL_REQUESTED_EVENT = "ApprovalRequested";
-const APPROVAL_DECIDED_EVENT = "ApprovalDecided";
-const APPROVAL_EXPIRED_EVENT = "ApprovalExpired";
-const APPROVAL_DECISION_REFUSED_EVENT = "ApprovalDecisionRefused";
-//#endregion
-//#region src/submission-refusal.ts
-/** Validate and copy only the descriptor's declared fields, on both sides of storage. */
-function submissionRefusalDescriptor(value) {
-	if (!value || typeof value !== "object") throw new Error("Invalid submission refusal descriptor.");
-	const fields = Object.getOwnPropertyDescriptors(value);
-	const data = (key) => fields[key]?.value;
-	const kind = data("class");
-	const keys = Reflect.ownKeys(value);
-	if ((kind === "entitlement" || kind === "authorization") && keys.length === 1) return { class: kind };
-	if (kind === "admission" && keys.every((key) => key === "class" || key === "refusal" || key === "refusalCode")) {
-		const refusal = data("refusal");
-		const code = data("refusalCode");
-		if (refusal === "invalid_parameters" && !Object.hasOwn(fields, "refusalCode")) return {
-			class: kind,
-			refusal
-		};
-		if (refusal === "refused" && (!Object.hasOwn(fields, "refusalCode") || typeof code === "string" && /^[a-z][A-Za-z0-9_.:-]{0,127}$/.test(code))) return {
-			class: kind,
-			refusal,
-			...code === void 0 ? {} : { refusalCode: code }
-		};
-	}
-	throw new Error("Invalid submission refusal descriptor.");
-}
-function validateRefusalRecord(record) {
-	if (record?.status === "submission_refused") submissionRefusalDescriptor(record.submissionRefusal);
-	return record;
-}
-/** Reconstruct errors from fixed validated evidence, without row error text or parameters. */
-function recordedSubmissionRefusal(record) {
-	const descriptor = submissionRefusalDescriptor(record.submissionRefusal);
-	return descriptor.class === "admission" ? new ActionAdmissionError(record.actionId, descriptor.refusal, descriptor.refusalCode, true) : new SubmissionRefusalError(record.actionId, descriptor.class, "", true);
-}
-/** Refusals enter the ledger through the narrow insert, rather than generic status writes. */
-function assertInvocationWriteStatus(status) {
-	if (status === "submission_refused") throw new Error("submission_refused can only be inserted by recordSubmissionRefusal.");
-}
-//#endregion
 //#region src/action-finalization.ts
 /** Remove private preparation and restore its compatible protocol on settlement. */
 function finalizationSettlementPatch(record, patch) {
@@ -1393,7 +1468,7 @@ function snapshotSubmission(input) {
 		...causationId != null ? { causationId } : {},
 		...executionReason != null ? { executionReason } : {},
 		...idempotencyKey != null ? { idempotencyKey } : {},
-		...authorizationBindingId != null ? { authorizationBindingId } : {},
+		...authorizationBindingId != null && authorizationBindingId !== "" ? { authorizationBindingId } : {},
 		parametersArePrivate: false
 	};
 	Object.defineProperties(live, {
@@ -4961,6 +5036,7 @@ function createGovernedActionHost(options) {
 	}
 	return {
 		...createStoredRecordErasureHost(options.store, options.authorization),
+		...createSubmissionOutcomeReader(options.store),
 		submitAction,
 		hasStagedInvocationActions: declaresStaging,
 		...stagedStore ? { dispatchStagedInvocations } : {},
@@ -5074,7 +5150,7 @@ function idempotencyConflict(existing, incoming) {
 	const reasons = [];
 	if (!existing.storedRecordsErased && digestParameters(existing.agentProposal ?? null) !== digestParameters(incoming.agentProposal ?? null)) reasons.push("agent_proposal");
 	if ((existing.idempotencyActorId ?? existing.actorId) !== incoming.actorId) reasons.push("actor");
-	if ((existing.idempotencyAuthorizationBindingId ?? existing.authorizationBindingId) !== incoming.authorizationBindingId) reasons.push("authority_binding");
+	if (((existing.idempotencyAuthorizationBindingId ?? existing.authorizationBindingId) || void 0) !== (incoming.authorizationBindingId || void 0)) reasons.push("authority_binding");
 	if (existing.actionVersion !== incoming.actionVersion) reasons.push("action_version");
 	if (!existing.storedRecordsErased && existing.parameterDigest !== incoming.parameterDigest) reasons.push("parameters");
 	return reasons.length ? {
@@ -5091,7 +5167,7 @@ function isKnownAdapterOutcome(outcome) {
 function refusalIdentityConflict(row, submission, actionVersion, parameterDigest) {
 	const reasons = [];
 	if (row.actorId !== submission.actorId || row.actorType !== submission.actorType) reasons.push("actor");
-	if (row.authorizationBindingId !== submission.authorizationBindingId) reasons.push("authority_binding");
+	if ((row.authorizationBindingId || void 0) !== (submission.authorizationBindingId || void 0)) reasons.push("authority_binding");
 	if (row.actionVersion !== actionVersion) reasons.push("action_version");
 	if (!row.storedRecordsErased && row.parameterDigest !== void 0 && row.parameterDigest !== parameterDigest) reasons.push("parameters");
 	return reasons.length ? {
@@ -5716,6 +5792,13 @@ function emitRelayTelemetry(telemetry, name, occurredAt, workerId, attributes) {
 //#region src/memory-store.ts
 var MemoryPlatformHostStore = class {
 	db;
+	async getSubmissionOutcomeByKey(key) {
+		const row = this.invocations.find((row) => row.tenantId === key.tenantId && row.spaceId === key.spaceId && row.actionId === key.actionId && row.idempotencyKey !== void 0 && row.idempotencyKey === key.idempotencyKey);
+		return row ? submissionOutcomeProjection({
+			...row,
+			idempotencyKey: row.idempotencyKey
+		}) : void 0;
+	}
 	transactionalOutbox;
 	transactionalApprovalLifecycle;
 	transactionalApprovalAuthorization = true;
@@ -7482,6 +7565,34 @@ var PostgresPlatformHostStore = class PostgresPlatformHostStore {
 	async transaction(run) {
 		return run(this.db);
 	}
+	async getSubmissionOutcomeByKey(key) {
+		const row = (await this.sql.query(`SELECT id,tenant_id,space_id,action_id,idempotency_key,action_version,actor_id,actor_type,
+				authorization_binding_id,idempotency_actor_id,idempotency_authorization_binding_id,status,
+				submission_refusal,records_erased_at FROM fabric_platform.action_invocations
+				WHERE tenant_id=$1 AND space_id=$2 AND action_id=$3 AND idempotency_key=$4`, [
+			key.tenantId,
+			key.spaceId,
+			key.actionId,
+			key.idempotencyKey
+		])).rows[0];
+		if (!row) return void 0;
+		return {
+			tenantId: row.tenant_id,
+			spaceId: row.space_id,
+			actionId: row.action_id,
+			idempotencyKey: row.idempotency_key,
+			id: row.id,
+			actionVersion: Number(row.action_version),
+			actorId: row.actor_id,
+			actorType: row.actor_type,
+			authorizationBindingId: row.authorization_binding_id ?? void 0,
+			idempotencyActorId: row.idempotency_actor_id ?? void 0,
+			idempotencyAuthorizationBindingId: row.idempotency_authorization_binding_id ?? void 0,
+			status: row.status,
+			submissionRefusal: row.submission_refusal ?? void 0,
+			storedRecordsErased: row.records_erased_at ? true : void 0
+		};
+	}
 	async createActionInvocation(input) {
 		assertInvocationWriteStatus(input.status);
 		const now = /* @__PURE__ */ new Date();
@@ -14300,6 +14411,161 @@ async function runInvocationIdempotencyChecks(subject) {
 	};
 }
 //#endregion
+//#region src/submission-outcome-conformance.ts
+/**
+* Isolated destructive probe with fresh identities and timestamps from new Date().
+* Refusal and erasure sections run only with their respective store capabilities;
+* returned evidence identifies each unexercised optional section with `skipped:`.
+*/
+async function checkSubmissionOutcomeStore(store) {
+	if (!store.getSubmissionOutcomeByKey) throw new Error("Missing getSubmissionOutcomeByKey");
+	const evidence = ["verified: submission outcome metadata and exact key scope"];
+	const id = globalThis.crypto.randomUUID();
+	const input = {
+		id,
+		tenantId: `tenant-${id}`,
+		spaceId: `space-${id}`,
+		actionId: "probe.read",
+		idempotencyKey: "",
+		actionVersion: 7,
+		actorId: "actor",
+		actorType: "natural_person",
+		authorizationBindingId: "authorization-binding",
+		idempotencyActorId: "idempotency-actor",
+		idempotencyAuthorizationBindingId: "idempotency-binding",
+		status: "pending",
+		parameters: {},
+		result: {},
+		correlationId: id
+	};
+	const key = {
+		tenantId: input.tenantId,
+		spaceId: input.spaceId,
+		actionId: input.actionId,
+		idempotencyKey: ""
+	};
+	const expected = {
+		...key,
+		id,
+		actionVersion: input.actionVersion,
+		actorId: input.actorId,
+		actorType: input.actorType,
+		authorizationBindingId: input.authorizationBindingId,
+		idempotencyActorId: input.idempotencyActorId,
+		idempotencyAuthorizationBindingId: input.idempotencyAuthorizationBindingId,
+		status: input.status,
+		submissionRefusal: void 0,
+		storedRecordsErased: void 0
+	};
+	const assertProjection = (row, receipt) => {
+		for (const field of Object.keys(receipt)) assertEqual(row?.[field], receipt[field], `receipt ${field}`);
+	};
+	assertEqual(await store.getSubmissionOutcomeByKey(key), void 0, "absence");
+	await store.createActionInvocation(input);
+	const before = structuredClone(await store.getActionInvocation(id, key.tenantId, key.spaceId));
+	for (const field of [
+		"tenantId",
+		"spaceId",
+		"actionId",
+		"idempotencyKey"
+	]) assertEqual(await store.getSubmissionOutcomeByKey({
+		...key,
+		[field]: "other.value"
+	}), void 0, field);
+	const spaced = {
+		...input,
+		id: `${id}-spaced`,
+		idempotencyKey: " key "
+	};
+	await store.createActionInvocation(spaced);
+	assertProjection(await store.getSubmissionOutcomeByKey(spaced), {
+		...expected,
+		id: spaced.id,
+		idempotencyKey: spaced.idempotencyKey
+	});
+	assertEqual(await store.getSubmissionOutcomeByKey({
+		...key,
+		idempotencyKey: "key"
+	}), void 0, "key is not trimmed");
+	const unkeyed = {
+		...input,
+		id: `${id}-unkeyed`,
+		actionId: "probe.unkeyed",
+		idempotencyKey: void 0
+	};
+	await store.createActionInvocation(unkeyed);
+	assertEqual(await store.getSubmissionOutcomeByKey({
+		...key,
+		actionId: unkeyed.actionId
+	}), void 0, "null key cannot match empty key");
+	const row = await store.getSubmissionOutcomeByKey(key);
+	assertProjection(row, expected);
+	if (row) row.actorId = "changed";
+	assertProjection(await store.getSubmissionOutcomeByKey(key), expected);
+	assertEqual(await store.getActionInvocation(id, key.tenantId, key.spaceId), before, "read writes nothing");
+	const erasureReceipts = [{
+		...expected,
+		status: "completed"
+	}];
+	if (store.recordSubmissionRefusal) {
+		const now = /* @__PURE__ */ new Date();
+		const refused = {
+			...key,
+			id: `${id}-refused`,
+			idempotencyKey: "refused",
+			actionVersion: 8,
+			actorId: "refused-actor",
+			actorType: "agent",
+			authorizationBindingId: "refused-binding",
+			correlationId: id,
+			submissionRefusal: { class: "authorization" },
+			createdAt: now,
+			updatedAt: now
+		};
+		await store.recordSubmissionRefusal(refused);
+		const refusedReceipt = {
+			...expected,
+			id: refused.id,
+			idempotencyKey: refused.idempotencyKey,
+			actionVersion: refused.actionVersion,
+			actorId: refused.actorId,
+			actorType: refused.actorType,
+			authorizationBindingId: refused.authorizationBindingId,
+			idempotencyActorId: void 0,
+			idempotencyAuthorizationBindingId: void 0,
+			status: "submission_refused",
+			submissionRefusal: refused.submissionRefusal
+		};
+		assertProjection(await store.getSubmissionOutcomeByKey(refused), refusedReceipt);
+		erasureReceipts.push(refusedReceipt);
+		evidence.push("verified: recorded refusal receipt");
+	} else evidence.push("skipped: store lacks recordSubmissionRefusal");
+	const erasable = store;
+	if (erasable.eraseStoredRecords) {
+		await store.updateActionInvocation(id, key.tenantId, key.spaceId, { status: "completed" });
+		for (const receipt of erasureReceipts) {
+			await erasable.eraseStoredRecords({
+				tenantId: key.tenantId,
+				spaceId: key.spaceId,
+				actorId: "operator",
+				actorType: "natural_person",
+				requestId: globalThis.crypto.randomUUID(),
+				targets: [{
+					kind: "invocation",
+					invocationId: receipt.id
+				}],
+				redact: (view) => view
+			});
+			assertProjection(await store.getSubmissionOutcomeByKey(receipt), {
+				...receipt,
+				storedRecordsErased: true
+			});
+		}
+		evidence.push("verified: erased receipts for created probe rows");
+	} else evidence.push("skipped: store lacks eraseStoredRecords");
+	return evidence;
+}
+//#endregion
 exports.APPROVAL_DECIDED_EVENT = APPROVAL_DECIDED_EVENT;
 exports.APPROVAL_DECISION_REFUSED_EVENT = APPROVAL_DECISION_REFUSED_EVENT;
 exports.APPROVAL_EXPIRED_EVENT = APPROVAL_EXPIRED_EVENT;
@@ -14327,6 +14593,7 @@ exports.STAGED_INVOCATION_KEY_PATTERN = STAGED_INVOCATION_KEY_PATTERN;
 exports.STAGED_INVOCATION_PRINCIPAL_PATTERN = STAGED_INVOCATION_PRINCIPAL_PATTERN;
 exports.StoredRecordErasureAuthorizationError = StoredRecordErasureAuthorizationError;
 exports.StoredRecordsErasedError = StoredRecordsErasedError;
+exports.SubmissionOutcomeUnsupportedError = SubmissionOutcomeUnsupportedError;
 exports.SubmissionRefusalError = SubmissionRefusalError;
 exports.applyPostgresMigrations = applyPostgresMigrations;
 exports.approvalChecks = approvalChecks;
@@ -14337,6 +14604,7 @@ Object.defineProperty(exports, "canonicalJson", {
 		return _fabricorg_platform.canonicalJson;
 	}
 });
+exports.checkSubmissionOutcomeStore = checkSubmissionOutcomeStore;
 exports.cloneOutboxRecord = cloneOutboxRecord;
 exports.cloneStagedInvocationRecord = cloneStagedInvocationRecord;
 exports.createDurableSagaParentLifecycle = createDurableSagaParentLifecycle;