@fabricorg/platform 0.7.0 → 0.9.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @fabricorg/platform
 
+## 0.9.0
+
+- Add versioned runtime-governance evidence shared by TypeScript and .NET hosts.
+- Publish the canonical governance contract generation and validation helpers.
+- Add language-neutral Fabric-family compatibility and conformance contracts.
+
+## 0.8.0 — 2026-07-20
+
+- Add provider-neutral external mutation governance contracts for footprints, delegated execution
+  principals, policy obligations, execution attestations, and reconciliation observations.
+- Add the `@fabricorg/platform/governance` public subpath.
+
 ## 0.7.0 — 2026-07-19
 
 ### Minor

package/README.md

@@ -53,6 +53,7 @@ That's what this package gives you. Nothing more.
 | `@fabricorg/platform/displays` | `DisplayRendererRegistration` |
 | `@fabricorg/platform/privacy` | Redaction + data classification |
 | `@fabricorg/platform/evidence` | Compliance evidence packets |
+| `@fabricorg/platform/governance` | External footprints, delegated principals, obligations, attestations, and reconciliation |
 | `@fabricorg/platform/objects` | Shared object-type contracts |
 | `@fabricorg/platform/testing` | In-memory adapter registry, fake `ActionContext`, deterministic IDs |
 

package/dist/chunk-3OWMPDBD.js

@@ -0,0 +1,30 @@
+// governance/index.ts
+var FABRIC_GOVERNANCE_CONTRACT_VERSION = 1;
+function assertMutationGovernanceContext(value) {
+  if (!Number.isInteger(value.footprint.version) || value.footprint.version < 1) {
+    throw new Error("Mutation footprint version must be a positive integer");
+  }
+  for (const entry of value.footprint.resources) {
+    if (!entry.resource.provider.trim()) throw new Error("Resource provider is required");
+    if (!entry.resource.resourceType.trim()) throw new Error("Resource type is required");
+    if (!entry.resource.resourceId.trim()) throw new Error("Resource id is required");
+  }
+  if (!value.executionPrincipal.principalId.trim()) {
+    throw new Error("Execution principal id is required");
+  }
+}
+function assertGovernanceRuntimeEvidence(value) {
+  if (!Number.isInteger(value.governanceContractVersion) || value.governanceContractVersion < 1) {
+    throw new Error("Governance contract version must be a positive integer");
+  }
+  if (!Number.isInteger(value.hostContractVersion) || value.hostContractVersion < 1) {
+    throw new Error("Host contract version must be a positive integer");
+  }
+  if (value.providerBridge && (!value.providerBridge.name.trim() || !value.providerBridge.version.trim())) {
+    throw new Error("Provider bridge name and version are required");
+  }
+}
+
+export { FABRIC_GOVERNANCE_CONTRACT_VERSION, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext };
+//# sourceMappingURL=chunk-3OWMPDBD.js.map
+//# sourceMappingURL=chunk-3OWMPDBD.js.map

package/dist/chunk-3OWMPDBD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../governance/index.ts"],"names":[],"mappings":";AAIO,IAAM,kCAAA,GAAqC;AA4G3C,SAAS,gCACf,KAAA,EACO;AACP,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAO,CAAA,IAAK,KAAA,CAAM,SAAA,CAAU,OAAA,GAAU,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACxE;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,SAAA,CAAU,SAAA,EAAW;AAC9C,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,QAAA,CAAS,MAAK,EAAG,MAAM,IAAI,KAAA,CAAM,+BAA+B,CAAA;AACpF,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,MAAK,EAAG,MAAM,IAAI,KAAA,CAAM,2BAA2B,CAAA;AACpF,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,MAAK,EAAG,MAAM,IAAI,KAAA,CAAM,yBAAyB,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,kBAAA,CAAmB,WAAA,CAAY,MAAK,EAAG;AACjD,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACrD;AACD;AAEO,SAAS,gCAAgC,KAAA,EAAwC;AACvF,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,KAAA,CAAM,yBAAyB,CAAA,IAAK,KAAA,CAAM,4BAA4B,CAAA,EAAG;AAC9F,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EACzE;AACA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,KAAA,CAAM,mBAAmB,CAAA,IAAK,KAAA,CAAM,sBAAsB,CAAA,EAAG;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,KAAA,CAAM,cAAA,KAAmB,CAAC,KAAA,CAAM,cAAA,CAAe,IAAA,CAAK,IAAA,EAAK,IAAK,CAAC,KAAA,CAAM,cAAA,CAAe,OAAA,CAAQ,MAAK,CAAA,EAAI;AACxG,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EAChE;AACD","file":"chunk-3OWMPDBD.js","sourcesContent":["import type { ActorType } from \"../actions\";\nimport type { EvidencePacketReference } from \"../evidence\";\n\n/** Language-neutral governance contract version shared by TypeScript and .NET. */\nexport const FABRIC_GOVERNANCE_CONTRACT_VERSION = 1 as const;\n\nexport type ExternalResourceOperation =\n\t| \"read\"\n\t| \"create\"\n\t| \"update\"\n\t| \"delete\"\n\t| \"execute\"\n\t| \"publish\";\n\n/** Provider-neutral identity for infrastructure touched by a governed mutation. */\nexport interface ExternalResourceRef {\n\tprovider: string;\n\tresourceType: string;\n\tresourceId: string;\n\tdisplayName?: string;\n\tmetadata?: Record<string, unknown>;\n}\n\nexport interface MutationFootprintEntry {\n\tresource: ExternalResourceRef;\n\toperation: ExternalResourceOperation;\n\tdataClassifications?: string[];\n}\n\n/** Durable declaration of the external effects an invocation is allowed to produce. */\nexport interface MutationFootprint {\n\tversion: number;\n\tresources: MutationFootprintEntry[];\n}\n\n/** Effective execution identity, including the delegation chain that produced it. */\nexport interface ExecutionPrincipal {\n\tprincipalId: string;\n\tprincipalType: ActorType | string;\n\tprovider?: string;\n\tdelegatedBy?: ExecutionPrincipal;\n\tmetadata?: Record<string, unknown>;\n}\n\nexport type PolicyObligationStatus = \"pending\" | \"satisfied\" | \"waived\" | \"failed\";\n\nexport interface PolicyObligation {\n\tid: string;\n\ttype: string;\n\tstatus: PolicyObligationStatus;\n\trequired?: boolean;\n\tdescription?: string;\n\tevidenceReferences?: EvidencePacketReference[];\n\tmetadata?: Record<string, unknown>;\n}\n\n/** Audit-safe proof returned by an external execution provider. */\nexport interface ExecutionAttestation {\n\tprovider: string;\n\toperation: string;\n\texternalOperationId?: string;\n\tresource?: ExternalResourceRef;\n\tevidenceReferences: EvidencePacketReference[];\n\tsatisfiesObligations?: string[];\n\tstartedAt: Date | string;\n\tcompletedAt?: Date | string;\n\tmetadata?: Record<string, unknown>;\n}\n\nexport type ReconciliationStatus = \"not_required\" | \"pending\" | \"reconciled\" | \"failed\";\n\nexport interface ExternalReconciliation {\n\tstatus: ReconciliationStatus;\n\tprovider: string;\n\texternalOperationId?: string;\n\tattempt: number;\n\treason?: string;\n\tevidenceReferences?: EvidencePacketReference[];\n\tobservedAt: Date | string;\n}\n\nexport interface MutationGovernanceContext {\n\tfootprint: MutationFootprint;\n\texecutionPrincipal: ExecutionPrincipal;\n}\n\n/** Runtime generations durably attached to every new hosted invocation. */\nexport interface GovernanceRuntimeEvidence {\n\tgovernanceContractVersion: number;\n\thostContractVersion: number;\n\thostPackageVersion?: string;\n\tproviderBridge?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\tpolicyRulesetVersion?: string;\n}\n\nexport interface MutationGovernanceResolutionInput {\n\tactionInvocationId: string;\n\tactionId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tparameters: unknown;\n}\n\nexport type MutationGovernanceResolver = (\n\tinput: MutationGovernanceResolutionInput,\n) => Promise<MutationGovernanceContext> | MutationGovernanceContext;\n\nexport function assertMutationGovernanceContext(\n\tvalue: MutationGovernanceContext,\n): void {\n\tif (!Number.isInteger(value.footprint.version) || value.footprint.version < 1) {\n\t\tthrow new Error(\"Mutation footprint version must be a positive integer\");\n\t}\n\tfor (const entry of value.footprint.resources) {\n\t\tif (!entry.resource.provider.trim()) throw new Error(\"Resource provider is required\");\n\t\tif (!entry.resource.resourceType.trim()) throw new Error(\"Resource type is required\");\n\t\tif (!entry.resource.resourceId.trim()) throw new Error(\"Resource id is required\");\n\t}\n\tif (!value.executionPrincipal.principalId.trim()) {\n\t\tthrow new Error(\"Execution principal id is required\");\n\t}\n}\n\nexport function assertGovernanceRuntimeEvidence(value: GovernanceRuntimeEvidence): void {\n\tif (!Number.isInteger(value.governanceContractVersion) || value.governanceContractVersion < 1) {\n\t\tthrow new Error(\"Governance contract version must be a positive integer\");\n\t}\n\tif (!Number.isInteger(value.hostContractVersion) || value.hostContractVersion < 1) {\n\t\tthrow new Error(\"Host contract version must be a positive integer\");\n\t}\n\tif (value.providerBridge && (!value.providerBridge.name.trim() || !value.providerBridge.version.trim())) {\n\t\tthrow new Error(\"Provider bridge name and version are required\");\n\t}\n}\n"]}

package/dist/chunk-ANPJYXBK.cjs

@@ -0,0 +1,34 @@
+'use strict';
+
+// governance/index.ts
+var FABRIC_GOVERNANCE_CONTRACT_VERSION = 1;
+function assertMutationGovernanceContext(value) {
+  if (!Number.isInteger(value.footprint.version) || value.footprint.version < 1) {
+    throw new Error("Mutation footprint version must be a positive integer");
+  }
+  for (const entry of value.footprint.resources) {
+    if (!entry.resource.provider.trim()) throw new Error("Resource provider is required");
+    if (!entry.resource.resourceType.trim()) throw new Error("Resource type is required");
+    if (!entry.resource.resourceId.trim()) throw new Error("Resource id is required");
+  }
+  if (!value.executionPrincipal.principalId.trim()) {
+    throw new Error("Execution principal id is required");
+  }
+}
+function assertGovernanceRuntimeEvidence(value) {
+  if (!Number.isInteger(value.governanceContractVersion) || value.governanceContractVersion < 1) {
+    throw new Error("Governance contract version must be a positive integer");
+  }
+  if (!Number.isInteger(value.hostContractVersion) || value.hostContractVersion < 1) {
+    throw new Error("Host contract version must be a positive integer");
+  }
+  if (value.providerBridge && (!value.providerBridge.name.trim() || !value.providerBridge.version.trim())) {
+    throw new Error("Provider bridge name and version are required");
+  }
+}
+
+exports.FABRIC_GOVERNANCE_CONTRACT_VERSION = FABRIC_GOVERNANCE_CONTRACT_VERSION;
+exports.assertGovernanceRuntimeEvidence = assertGovernanceRuntimeEvidence;
+exports.assertMutationGovernanceContext = assertMutationGovernanceContext;
+//# sourceMappingURL=chunk-ANPJYXBK.cjs.map
+//# sourceMappingURL=chunk-ANPJYXBK.cjs.map

package/dist/chunk-ANPJYXBK.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../governance/index.ts"],"names":[],"mappings":";;;AAIO,IAAM,kCAAA,GAAqC;AA4G3C,SAAS,gCACf,KAAA,EACO;AACP,EAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,KAAA,CAAM,SAAA,CAAU,OAAO,CAAA,IAAK,KAAA,CAAM,SAAA,CAAU,OAAA,GAAU,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACxE;AACA,EAAA,KAAA,MAAW,KAAA,IAAS,KAAA,CAAM,SAAA,CAAU,SAAA,EAAW;AAC9C,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,QAAA,CAAS,MAAK,EAAG,MAAM,IAAI,KAAA,CAAM,+BAA+B,CAAA;AACpF,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,YAAA,CAAa,MAAK,EAAG,MAAM,IAAI,KAAA,CAAM,2BAA2B,CAAA;AACpF,IAAA,IAAI,CAAC,MAAM,QAAA,CAAS,UAAA,CAAW,MAAK,EAAG,MAAM,IAAI,KAAA,CAAM,yBAAyB,CAAA;AAAA,EACjF;AACA,EAAA,IAAI,CAAC,KAAA,CAAM,kBAAA,CAAmB,WAAA,CAAY,MAAK,EAAG;AACjD,IAAA,MAAM,IAAI,MAAM,oCAAoC,CAAA;AAAA,EACrD;AACD;AAEO,SAAS,gCAAgC,KAAA,EAAwC;AACvF,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,KAAA,CAAM,yBAAyB,CAAA,IAAK,KAAA,CAAM,4BAA4B,CAAA,EAAG;AAC9F,IAAA,MAAM,IAAI,MAAM,wDAAwD,CAAA;AAAA,EACzE;AACA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,KAAA,CAAM,mBAAmB,CAAA,IAAK,KAAA,CAAM,sBAAsB,CAAA,EAAG;AAClF,IAAA,MAAM,IAAI,MAAM,kDAAkD,CAAA;AAAA,EACnE;AACA,EAAA,IAAI,KAAA,CAAM,cAAA,KAAmB,CAAC,KAAA,CAAM,cAAA,CAAe,IAAA,CAAK,IAAA,EAAK,IAAK,CAAC,KAAA,CAAM,cAAA,CAAe,OAAA,CAAQ,MAAK,CAAA,EAAI;AACxG,IAAA,MAAM,IAAI,MAAM,+CAA+C,CAAA;AAAA,EAChE;AACD","file":"chunk-ANPJYXBK.cjs","sourcesContent":["import type { ActorType } from \"../actions\";\nimport type { EvidencePacketReference } from \"../evidence\";\n\n/** Language-neutral governance contract version shared by TypeScript and .NET. */\nexport const FABRIC_GOVERNANCE_CONTRACT_VERSION = 1 as const;\n\nexport type ExternalResourceOperation =\n\t| \"read\"\n\t| \"create\"\n\t| \"update\"\n\t| \"delete\"\n\t| \"execute\"\n\t| \"publish\";\n\n/** Provider-neutral identity for infrastructure touched by a governed mutation. */\nexport interface ExternalResourceRef {\n\tprovider: string;\n\tresourceType: string;\n\tresourceId: string;\n\tdisplayName?: string;\n\tmetadata?: Record<string, unknown>;\n}\n\nexport interface MutationFootprintEntry {\n\tresource: ExternalResourceRef;\n\toperation: ExternalResourceOperation;\n\tdataClassifications?: string[];\n}\n\n/** Durable declaration of the external effects an invocation is allowed to produce. */\nexport interface MutationFootprint {\n\tversion: number;\n\tresources: MutationFootprintEntry[];\n}\n\n/** Effective execution identity, including the delegation chain that produced it. */\nexport interface ExecutionPrincipal {\n\tprincipalId: string;\n\tprincipalType: ActorType | string;\n\tprovider?: string;\n\tdelegatedBy?: ExecutionPrincipal;\n\tmetadata?: Record<string, unknown>;\n}\n\nexport type PolicyObligationStatus = \"pending\" | \"satisfied\" | \"waived\" | \"failed\";\n\nexport interface PolicyObligation {\n\tid: string;\n\ttype: string;\n\tstatus: PolicyObligationStatus;\n\trequired?: boolean;\n\tdescription?: string;\n\tevidenceReferences?: EvidencePacketReference[];\n\tmetadata?: Record<string, unknown>;\n}\n\n/** Audit-safe proof returned by an external execution provider. */\nexport interface ExecutionAttestation {\n\tprovider: string;\n\toperation: string;\n\texternalOperationId?: string;\n\tresource?: ExternalResourceRef;\n\tevidenceReferences: EvidencePacketReference[];\n\tsatisfiesObligations?: string[];\n\tstartedAt: Date | string;\n\tcompletedAt?: Date | string;\n\tmetadata?: Record<string, unknown>;\n}\n\nexport type ReconciliationStatus = \"not_required\" | \"pending\" | \"reconciled\" | \"failed\";\n\nexport interface ExternalReconciliation {\n\tstatus: ReconciliationStatus;\n\tprovider: string;\n\texternalOperationId?: string;\n\tattempt: number;\n\treason?: string;\n\tevidenceReferences?: EvidencePacketReference[];\n\tobservedAt: Date | string;\n}\n\nexport interface MutationGovernanceContext {\n\tfootprint: MutationFootprint;\n\texecutionPrincipal: ExecutionPrincipal;\n}\n\n/** Runtime generations durably attached to every new hosted invocation. */\nexport interface GovernanceRuntimeEvidence {\n\tgovernanceContractVersion: number;\n\thostContractVersion: number;\n\thostPackageVersion?: string;\n\tproviderBridge?: {\n\t\tname: string;\n\t\tversion: string;\n\t};\n\tpolicyRulesetVersion?: string;\n}\n\nexport interface MutationGovernanceResolutionInput {\n\tactionInvocationId: string;\n\tactionId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tparameters: unknown;\n}\n\nexport type MutationGovernanceResolver = (\n\tinput: MutationGovernanceResolutionInput,\n) => Promise<MutationGovernanceContext> | MutationGovernanceContext;\n\nexport function assertMutationGovernanceContext(\n\tvalue: MutationGovernanceContext,\n): void {\n\tif (!Number.isInteger(value.footprint.version) || value.footprint.version < 1) {\n\t\tthrow new Error(\"Mutation footprint version must be a positive integer\");\n\t}\n\tfor (const entry of value.footprint.resources) {\n\t\tif (!entry.resource.provider.trim()) throw new Error(\"Resource provider is required\");\n\t\tif (!entry.resource.resourceType.trim()) throw new Error(\"Resource type is required\");\n\t\tif (!entry.resource.resourceId.trim()) throw new Error(\"Resource id is required\");\n\t}\n\tif (!value.executionPrincipal.principalId.trim()) {\n\t\tthrow new Error(\"Execution principal id is required\");\n\t}\n}\n\nexport function assertGovernanceRuntimeEvidence(value: GovernanceRuntimeEvidence): void {\n\tif (!Number.isInteger(value.governanceContractVersion) || value.governanceContractVersion < 1) {\n\t\tthrow new Error(\"Governance contract version must be a positive integer\");\n\t}\n\tif (!Number.isInteger(value.hostContractVersion) || value.hostContractVersion < 1) {\n\t\tthrow new Error(\"Host contract version must be a positive integer\");\n\t}\n\tif (value.providerBridge && (!value.providerBridge.name.trim() || !value.providerBridge.version.trim())) {\n\t\tthrow new Error(\"Provider bridge name and version are required\");\n\t}\n}\n"]}

package/dist/governance/index.cjs

@@ -0,0 +1,20 @@
+'use strict';
+
+var chunkANPJYXBK_cjs = require('../chunk-ANPJYXBK.cjs');
+
+
+
+Object.defineProperty(exports, "FABRIC_GOVERNANCE_CONTRACT_VERSION", {
+  enumerable: true,
+  get: function () { return chunkANPJYXBK_cjs.FABRIC_GOVERNANCE_CONTRACT_VERSION; }
+});
+Object.defineProperty(exports, "assertGovernanceRuntimeEvidence", {
+  enumerable: true,
+  get: function () { return chunkANPJYXBK_cjs.assertGovernanceRuntimeEvidence; }
+});
+Object.defineProperty(exports, "assertMutationGovernanceContext", {
+  enumerable: true,
+  get: function () { return chunkANPJYXBK_cjs.assertMutationGovernanceContext; }
+});
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/governance/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.cjs"}

package/dist/governance/index.d.cts

@@ -0,0 +1,93 @@
+import { ActorType } from '../actions/index.cjs';
+import { EvidencePacketReference } from '../evidence/index.cjs';
+
+/** Language-neutral governance contract version shared by TypeScript and .NET. */
+declare const FABRIC_GOVERNANCE_CONTRACT_VERSION: 1;
+type ExternalResourceOperation = "read" | "create" | "update" | "delete" | "execute" | "publish";
+/** Provider-neutral identity for infrastructure touched by a governed mutation. */
+interface ExternalResourceRef {
+    provider: string;
+    resourceType: string;
+    resourceId: string;
+    displayName?: string;
+    metadata?: Record<string, unknown>;
+}
+interface MutationFootprintEntry {
+    resource: ExternalResourceRef;
+    operation: ExternalResourceOperation;
+    dataClassifications?: string[];
+}
+/** Durable declaration of the external effects an invocation is allowed to produce. */
+interface MutationFootprint {
+    version: number;
+    resources: MutationFootprintEntry[];
+}
+/** Effective execution identity, including the delegation chain that produced it. */
+interface ExecutionPrincipal {
+    principalId: string;
+    principalType: ActorType | string;
+    provider?: string;
+    delegatedBy?: ExecutionPrincipal;
+    metadata?: Record<string, unknown>;
+}
+type PolicyObligationStatus = "pending" | "satisfied" | "waived" | "failed";
+interface PolicyObligation {
+    id: string;
+    type: string;
+    status: PolicyObligationStatus;
+    required?: boolean;
+    description?: string;
+    evidenceReferences?: EvidencePacketReference[];
+    metadata?: Record<string, unknown>;
+}
+/** Audit-safe proof returned by an external execution provider. */
+interface ExecutionAttestation {
+    provider: string;
+    operation: string;
+    externalOperationId?: string;
+    resource?: ExternalResourceRef;
+    evidenceReferences: EvidencePacketReference[];
+    satisfiesObligations?: string[];
+    startedAt: Date | string;
+    completedAt?: Date | string;
+    metadata?: Record<string, unknown>;
+}
+type ReconciliationStatus = "not_required" | "pending" | "reconciled" | "failed";
+interface ExternalReconciliation {
+    status: ReconciliationStatus;
+    provider: string;
+    externalOperationId?: string;
+    attempt: number;
+    reason?: string;
+    evidenceReferences?: EvidencePacketReference[];
+    observedAt: Date | string;
+}
+interface MutationGovernanceContext {
+    footprint: MutationFootprint;
+    executionPrincipal: ExecutionPrincipal;
+}
+/** Runtime generations durably attached to every new hosted invocation. */
+interface GovernanceRuntimeEvidence {
+    governanceContractVersion: number;
+    hostContractVersion: number;
+    hostPackageVersion?: string;
+    providerBridge?: {
+        name: string;
+        version: string;
+    };
+    policyRulesetVersion?: string;
+}
+interface MutationGovernanceResolutionInput {
+    actionInvocationId: string;
+    actionId: string;
+    tenantId: string;
+    spaceId: string;
+    actorId: string;
+    actorType: ActorType;
+    parameters: unknown;
+}
+type MutationGovernanceResolver = (input: MutationGovernanceResolutionInput) => Promise<MutationGovernanceContext> | MutationGovernanceContext;
+declare function assertMutationGovernanceContext(value: MutationGovernanceContext): void;
+declare function assertGovernanceRuntimeEvidence(value: GovernanceRuntimeEvidence): void;
+
+export { type ExecutionAttestation, type ExecutionPrincipal, type ExternalReconciliation, type ExternalResourceOperation, type ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, type GovernanceRuntimeEvidence, type MutationFootprint, type MutationFootprintEntry, type MutationGovernanceContext, type MutationGovernanceResolutionInput, type MutationGovernanceResolver, type PolicyObligation, type PolicyObligationStatus, type ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext };

package/dist/governance/index.d.ts

@@ -0,0 +1,93 @@
+import { ActorType } from '../actions/index.js';
+import { EvidencePacketReference } from '../evidence/index.js';
+
+/** Language-neutral governance contract version shared by TypeScript and .NET. */
+declare const FABRIC_GOVERNANCE_CONTRACT_VERSION: 1;
+type ExternalResourceOperation = "read" | "create" | "update" | "delete" | "execute" | "publish";
+/** Provider-neutral identity for infrastructure touched by a governed mutation. */
+interface ExternalResourceRef {
+    provider: string;
+    resourceType: string;
+    resourceId: string;
+    displayName?: string;
+    metadata?: Record<string, unknown>;
+}
+interface MutationFootprintEntry {
+    resource: ExternalResourceRef;
+    operation: ExternalResourceOperation;
+    dataClassifications?: string[];
+}
+/** Durable declaration of the external effects an invocation is allowed to produce. */
+interface MutationFootprint {
+    version: number;
+    resources: MutationFootprintEntry[];
+}
+/** Effective execution identity, including the delegation chain that produced it. */
+interface ExecutionPrincipal {
+    principalId: string;
+    principalType: ActorType | string;
+    provider?: string;
+    delegatedBy?: ExecutionPrincipal;
+    metadata?: Record<string, unknown>;
+}
+type PolicyObligationStatus = "pending" | "satisfied" | "waived" | "failed";
+interface PolicyObligation {
+    id: string;
+    type: string;
+    status: PolicyObligationStatus;
+    required?: boolean;
+    description?: string;
+    evidenceReferences?: EvidencePacketReference[];
+    metadata?: Record<string, unknown>;
+}
+/** Audit-safe proof returned by an external execution provider. */
+interface ExecutionAttestation {
+    provider: string;
+    operation: string;
+    externalOperationId?: string;
+    resource?: ExternalResourceRef;
+    evidenceReferences: EvidencePacketReference[];
+    satisfiesObligations?: string[];
+    startedAt: Date | string;
+    completedAt?: Date | string;
+    metadata?: Record<string, unknown>;
+}
+type ReconciliationStatus = "not_required" | "pending" | "reconciled" | "failed";
+interface ExternalReconciliation {
+    status: ReconciliationStatus;
+    provider: string;
+    externalOperationId?: string;
+    attempt: number;
+    reason?: string;
+    evidenceReferences?: EvidencePacketReference[];
+    observedAt: Date | string;
+}
+interface MutationGovernanceContext {
+    footprint: MutationFootprint;
+    executionPrincipal: ExecutionPrincipal;
+}
+/** Runtime generations durably attached to every new hosted invocation. */
+interface GovernanceRuntimeEvidence {
+    governanceContractVersion: number;
+    hostContractVersion: number;
+    hostPackageVersion?: string;
+    providerBridge?: {
+        name: string;
+        version: string;
+    };
+    policyRulesetVersion?: string;
+}
+interface MutationGovernanceResolutionInput {
+    actionInvocationId: string;
+    actionId: string;
+    tenantId: string;
+    spaceId: string;
+    actorId: string;
+    actorType: ActorType;
+    parameters: unknown;
+}
+type MutationGovernanceResolver = (input: MutationGovernanceResolutionInput) => Promise<MutationGovernanceContext> | MutationGovernanceContext;
+declare function assertMutationGovernanceContext(value: MutationGovernanceContext): void;
+declare function assertGovernanceRuntimeEvidence(value: GovernanceRuntimeEvidence): void;
+
+export { type ExecutionAttestation, type ExecutionPrincipal, type ExternalReconciliation, type ExternalResourceOperation, type ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, type GovernanceRuntimeEvidence, type MutationFootprint, type MutationFootprintEntry, type MutationGovernanceContext, type MutationGovernanceResolutionInput, type MutationGovernanceResolver, type PolicyObligation, type PolicyObligationStatus, type ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext };

package/dist/governance/index.js

@@ -0,0 +1,3 @@
+export { FABRIC_GOVERNANCE_CONTRACT_VERSION, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from '../chunk-3OWMPDBD.js';
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/governance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}

package/dist/index.cjs

@@ -1,5 +1,6 @@
 'use strict';
 
+var chunkLZSE6QGQ_cjs = require('./chunk-LZSE6QGQ.cjs');
 var chunkSSYKDXR4_cjs = require('./chunk-SSYKDXR4.cjs');
 var chunkQETQGAXJ_cjs = require('./chunk-QETQGAXJ.cjs');
 var chunkNJL3US7H_cjs = require('./chunk-NJL3US7H.cjs');
@@ -13,10 +14,26 @@ var chunkF3E5SXPN_cjs = require('./chunk-F3E5SXPN.cjs');
 var chunkEO4VSB2O_cjs = require('./chunk-EO4VSB2O.cjs');
 var chunkJAXDEK5Z_cjs = require('./chunk-JAXDEK5Z.cjs');
 require('./chunk-PG5LYTUX.cjs');
-var chunkLZSE6QGQ_cjs = require('./chunk-LZSE6QGQ.cjs');
+var chunkANPJYXBK_cjs = require('./chunk-ANPJYXBK.cjs');
 
 
 
+Object.defineProperty(exports, "FABRIC_ID_PREFIXES", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.FABRIC_ID_PREFIXES; }
+});
+Object.defineProperty(exports, "createFabricId", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.createFabricId; }
+});
+Object.defineProperty(exports, "isFabricId", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.isFabricId; }
+});
+Object.defineProperty(exports, "parseFabricId", {
+  enumerable: true,
+  get: function () { return chunkLZSE6QGQ_cjs.parseFabricId; }
+});
 Object.defineProperty(exports, "createModuleRegistry", {
   enumerable: true,
   get: function () { return chunkSSYKDXR4_cjs.createModuleRegistry; }
@@ -289,21 +306,17 @@ Object.defineProperty(exports, "registerSubjectType", {
   enumerable: true,
   get: function () { return chunkJAXDEK5Z_cjs.registerSubjectType; }
 });
-Object.defineProperty(exports, "FABRIC_ID_PREFIXES", {
-  enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.FABRIC_ID_PREFIXES; }
-});
-Object.defineProperty(exports, "createFabricId", {
+Object.defineProperty(exports, "FABRIC_GOVERNANCE_CONTRACT_VERSION", {
   enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.createFabricId; }
+  get: function () { return chunkANPJYXBK_cjs.FABRIC_GOVERNANCE_CONTRACT_VERSION; }
 });
-Object.defineProperty(exports, "isFabricId", {
+Object.defineProperty(exports, "assertGovernanceRuntimeEvidence", {
   enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.isFabricId; }
+  get: function () { return chunkANPJYXBK_cjs.assertGovernanceRuntimeEvidence; }
 });
-Object.defineProperty(exports, "parseFabricId", {
+Object.defineProperty(exports, "assertMutationGovernanceContext", {
   enumerable: true,
-  get: function () { return chunkLZSE6QGQ_cjs.parseFabricId; }
+  get: function () { return chunkANPJYXBK_cjs.assertMutationGovernanceContext; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/index.d.cts

@@ -10,5 +10,6 @@ export { ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, R
 export { CachedDisplayDescriptor, DisplayContext, DisplayDatabaseClient, DisplayDescriptor, DisplayRenderer, DisplayRendererRegistration, denormalizeDisplaySnapshot, registerDisplayRenderer, renderEventDisplay, resolveDisplayRenderer } from './displays/index.cjs';
 export { ANONYMIZATION_POLICY_VERSION, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, AnonymizationFieldMetadata, AnonymizationLifecycleEvidence, AnonymizationMetadata, AnonymizationResult, AssetEventLike, DataClassificationRule, EvidencePacketLike, FieldRedactor, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, RedactionMethod, RedactionRule, RetentionRule, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, buildAnonymizationLifecycleEvidence, stableChecksum } from './privacy/index.cjs';
 export { EvidenceGenerationContext, EvidencePacketEnvelope, EvidencePacketReference, EvidencePacketStatus, EvidencePacketSubject, EvidenceRenderer } from './evidence/index.cjs';
+export { ExecutionAttestation, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, GovernanceRuntimeEvidence, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, PolicyObligation, PolicyObligationStatus, ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from './governance/index.cjs';
 export { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from './agent-hitl/index.cjs';
 export { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from './testing/index.cjs';

package/dist/index.d.ts

@@ -10,5 +10,6 @@ export { ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, R
 export { CachedDisplayDescriptor, DisplayContext, DisplayDatabaseClient, DisplayDescriptor, DisplayRenderer, DisplayRendererRegistration, denormalizeDisplaySnapshot, registerDisplayRenderer, renderEventDisplay, resolveDisplayRenderer } from './displays/index.js';
 export { ANONYMIZATION_POLICY_VERSION, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, AnonymizationFieldMetadata, AnonymizationLifecycleEvidence, AnonymizationMetadata, AnonymizationResult, AssetEventLike, DataClassificationRule, EvidencePacketLike, FieldRedactor, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, RedactionMethod, RedactionRule, RetentionRule, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, buildAnonymizationLifecycleEvidence, stableChecksum } from './privacy/index.js';
 export { EvidenceGenerationContext, EvidencePacketEnvelope, EvidencePacketReference, EvidencePacketStatus, EvidencePacketSubject, EvidenceRenderer } from './evidence/index.js';
+export { ExecutionAttestation, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, GovernanceRuntimeEvidence, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, PolicyObligation, PolicyObligationStatus, ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from './governance/index.js';
 export { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from './agent-hitl/index.js';
 export { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from './testing/index.js';

package/dist/index.js

@@ -1,3 +1,4 @@
+export { FABRIC_ID_PREFIXES, createFabricId, isFabricId, parseFabricId } from './chunk-RALMUSOX.js';
 export { createModuleRegistry, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, registerFabricModule, registerFabricModules, validateModuleNamespace } from './chunk-35DD3H55.js';
 export { assertObjectType, getRegisteredObjectTypes, isValidObjectType, registerObjectType } from './chunk-I35B576X.js';
 export { aggregatePolicyOutcomes, assertPolicyId, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, getRegisteredPolicyIds, registerPolicy, registerPolicyIfMissing, resolvePolicy, validateDataPolicyDefinition, validatePolicyGuidance } from './chunk-6ER62UUN.js';
@@ -11,6 +12,6 @@ export { AgentActionPolicyRegistry } from './chunk-OFCCZ27Z.js';
 export { denormalizeDisplaySnapshot, registerDisplayRenderer, renderEventDisplay, resolveDisplayRenderer } from './chunk-O5WVBQ7P.js';
 export { createEventTypeRegistry, getRegisteredEventTypes, getRegisteredSubjectTypes, isValidEventType, isValidSubjectType, registerEventType, registerSubjectType } from './chunk-4YQOGV7H.js';
 import './chunk-OZLZHISS.js';
-export { FABRIC_ID_PREFIXES, createFabricId, isFabricId, parseFabricId } from './chunk-RALMUSOX.js';
+export { FABRIC_GOVERNANCE_CONTRACT_VERSION, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from './chunk-3OWMPDBD.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fabricorg/platform",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Generic, vertical-agnostic runtime for ontology-based business applications. Provides actions, modules, events, policies, state machines, adapters, displays, projections, privacy, and evidence contracts. Zero runtime dependencies; portable across any database client and any vertical (lending, insurance, healthcare, legal, etc.).",
   "keywords": [
     "fabric",
@@ -98,6 +98,16 @@
         "default": "./dist/evidence/index.cjs"
       }
     },
+    "./governance": {
+      "import": {
+        "types": "./dist/governance/index.d.ts",
+        "default": "./dist/governance/index.js"
+      },
+      "require": {
+        "types": "./dist/governance/index.d.cts",
+        "default": "./dist/governance/index.cjs"
+      }
+    },
     "./ids": {
       "import": {
         "types": "./dist/ids/index.d.ts",