@fabricorg/platform 1.0.0 → 1.2.0

package/CHANGELOG.md

@@ -1,5 +1,80 @@
 # @fabricorg/platform
 
+## 1.2.0
+
+### Minor Changes
+
+- ef4e3eb: Classify adapter outcomes: add additive `AdapterOutcomeKind` (`success`, `transient_failure`,
+  `permanent_failure`, `timeout`, `ambiguous`) and `AdapterOutcomeEvidence` to the portable adapter
+  contract. The retry layer now retries only transient idempotent outcomes; permanent failures,
+  timeouts, and ambiguous results are never retried. Ambiguous outcomes are routed to
+  `reconciliation_required` with durable `ExternalReconciliation` evidence and an
+  `AdapterInvocationAmbiguous` lifecycle event. Add deadline and cancellation context to
+  `AdapterExecutionContext`. Backward compatible: adapters that omit `outcome` behave as before.
+- 293561d: Close adapter and saga correctness gaps: deliver actual deadline and AbortSignal context to adapters, require the governed Host to classify thrown adapter failures before retrying, reject contradictory successful ambiguous outcomes, reserve parent lifecycle identity prefixes, and provide a durable Platform Host parent lifecycle adapter tested through public store seams. Direct `executeWithAdapterRetry` callers retain the prior idempotent retry default when they omit a classifier.
+- 9a145a3: Add assembly and initiating SDUI release digests to durable governance runtime
+  evidence. Hosts can attach both through trusted configuration, including a
+  per-submission release resolver, and validate digest shape before creating the
+  invocation. Composition-bound hosts verify their assembly lockfile against the
+  exact loaded capability artifacts before accepting submissions.
+- b932767: Add portable parameter schemas and validation for projection views. Projection snapshot keys now
+  include a canonical parameter identity, generated capability and experience contracts preserve view
+  parameter schemas, and compatible snapshots continue through the explicit `upgradeSnapshot` seam.
+- fb14d67: Execute state guards with trusted Host context, correct filtered-ledger replay semantics, make
+  dispatcher failure retryable, fail closed for unsafe saga and non-idempotent recovery paths, preserve
+  outbox consistency, and bound and redact OPA HTTP failures.
+
+### Additional release notes
+
+### Minor Changes
+
+- Add additive adapter outcome classification (`AdapterOutcomeKind`: `success`, `transient_failure`,
+  `permanent_failure`, `timeout`, `ambiguous`) and `AdapterOutcomeEvidence`. The retry layer retries
+  only transient idempotent outcomes. Add deadline and cancellation context to
+  `AdapterExecutionContext`. Backward compatible: adapters that omit `outcome` behave as before.
+- Add `signal?: AbortSignal` to `AdapterExecutionContext` so the host can deliver a real
+  cancellation signal to adapters. Add `classifyThrownError` to `ExecuteWithRetryOptions`:
+  thrown errors are never retried without explicit classification (fail safe). Add
+  `assertAdapterOutcomeConsistency` to reject contradictory results where `success` is true
+  but the explicit `outcome` is a non-success kind.
+- Add guard-aware state transition evaluation that fails closed on guard denial or exceptions.
+- Clarify that projection `sequence` is a global ledger cursor and add optional
+  `subjectSequence` for sources that can prove subject-local continuity.
+- Add portable JSON Schema validation for projection parameters and expose
+  `ViewContract.parameterSchema` for parameterized view variants.
+- Add optional module `version` and compiler `manifestDigest` identity for
+  assembly-verified runtime registration, plus durable assembly and initiating
+  release digests in `GovernanceRuntimeEvidence`.
+
+## 1.1.0
+
+### Minor Changes
+
+- c504d0a: Make durability a declared, diffable contract.
+
+  `CapabilityMetadata` gains `workflows`: each declares its task queue, the event that starts it, the
+  durable deadlines it carries (resolved from configuration keys, never literals), and which governed
+  action reverses each compensatable step. The field is additive, so `MODULE_MANIFEST_VERSION` stays
+  at 2.
+
+  `diffModuleManifests` classifies this plane instead of reporting one blanket capability change:
+  adding a workflow, timer or reversal is compatible; moving a task queue, changing a trigger, dropping
+  a deadline or repointing a reversal is potentially breaking; removing a workflow or reversal is
+  breaking.
+
+  The compiler validates serialized workflow declarations, which never pass through a registry, and
+  rejects an action declaring `completion: "immediate"` while `kind: "saga"` — a manifest contradiction
+  that now fails the build rather than a running host.
+
+  `platform-temporal` executes declared reversals. `runCompensatedSaga` unwinds newest-first, routes
+  every reversal through the governed Host under a distinct deterministic
+  `compensationInvocationIdentity`, and surfaces a reversal that itself failed on
+  `SagaCompensationError` rather than swallowing it. A step that _resolves_ with a non-successful
+  status — blocked, failed, parked for approval, sent to reconciliation — now triggers the unwind
+  instead of being recorded as completed. Step identities must be unique and may not use the reserved
+  `compensate:` prefix, and when a `workflow` declaration is supplied every reversal is checked against
+  it.
+
 ## 1.0.0
 
 ### Major Changes

package/README.md

@@ -44,7 +44,7 @@ That's what this package gives you. Nothing more.
 | `@fabricorg/platform` | Re-exports everything below |
 | `@fabricorg/platform/actions` | `ActionDefinition`, `ActionContext`, `SagaImplementation` |
 | `@fabricorg/platform/policies` | `PolicyEvaluator`, `PolicyContext`, code/data/hybrid evaluation |
-| `@fabricorg/platform/state-machines` | `StateMachineDefinition`, `validateTransition` |
+| `@fabricorg/platform/state-machines` | `StateMachineDefinition`, structural and guard-aware transition evaluation |
 | `@fabricorg/platform/events` | `AssetEventEnvelope`, `EventTypeRegistry` |
 | `@fabricorg/platform/projections` | Replay/snapshot framework |
 | `@fabricorg/platform/adapters` | `AdapterRegistry`, retry + circuit-breaker |
@@ -57,10 +57,12 @@ That's what this package gives you. Nothing more.
 | `@fabricorg/platform/objects` | Shared object-type contracts |
 | `@fabricorg/platform/testing` | In-memory adapter registry, fake `ActionContext`, deterministic IDs |
 
-Modules may publish versioned `ViewContract`s. `replayView` filters declared event schema versions and
-requires an explicit upgrade function before resuming an older compatible snapshot; manifests serialize
-the logical shape and metadata but never executable functions or initial state. Physical stores remain
-adapter concerns.
+Modules may publish versioned `ViewContract`s. A view may also declare a portable `parameterSchema`;
+ProjectionHost validates those inputs and keeps each canonical parameter identity in a separate
+snapshot. `replayView` filters declared event schema versions and requires an explicit
+`upgradeSnapshot` function before resuming an older compatible snapshot; manifests serialize the
+logical shape, parameter schema, and metadata but never executable functions or initial state.
+Physical stores remain adapter concerns.
 
 ## Composing a vertical
 
@@ -105,9 +107,9 @@ An entity schema does not validate arbitrary writes through `TDb`. Persisted-rec
 Every `invokeAction(id, params)` call goes through:
 
 1. **`evaluatePolicies`** — every policy registered for the action runs (code/data/hybrid). A single `block` halts the invocation. Policies may return `guidance` (`factsUsed` + typed `correctiveActions`) so hosts can show exactly why a block happened and what the operator can do next. Corrective actions declare `kind: "invoke_action" | "navigate" | "manual"` so UIs do not guess whether a remediation is executable.
-2. **State-machine validation** — if the action's target entity is bound to a state machine, the requested transition is validated before the handler runs.
+2. **State-machine validation** — if the action's target entity is bound to a state machine, the Host reads authoritative state at the mutation boundary, validates the requested transition, and executes its guard with trusted entity, actor, parameter, invocation, and database context. A false or throwing guard fails closed.
 3. **Handler** — `actionDef.handler(ctx, params)` runs inside a single `TDb` transaction. Handler parses its own input via its `schema` (single source of truth).
-4. **Adapters** — for each `actionDef.adapterSteps`, the registered implementation runs via `executeWithAdapterRetry` (idempotent retry, exponential backoff, circuit breaker).
+4. **Adapters** — for each `actionDef.adapterSteps`, the registered implementation runs via `executeWithAdapterRetry` (idempotent retry, exponential backoff, circuit breaker). Adapters may classify outcomes as `success`, `transient_failure`, `permanent_failure`, `timeout`, or `ambiguous`; only transient idempotent outcomes are retried. Ambiguous outcomes are routed to `reconciliation_required` with durable evidence.
 5. **Events** — domain events are appended; projections derive read models on next replay.
 6. **Completion** — invocation status is marked, telemetry emitted.
 
@@ -136,6 +138,17 @@ export const ingestSaga: SagaImplementation = async (ctx, runChild) => {
 
 Your worker maps action IDs to implementations. The platform dispatches generically — no platform code references vertical action IDs.
 
+`PlatformHost` does not execute a `kind: "saga"` definition as an atomic handler. Configure a
+durable dispatcher and map the action to its saga implementation in the workflow worker. Direct
+execution fails closed so a handlerless saga cannot be recorded as completed.
+
+## Projection sequence semantics
+
+`ReplayableAssetEvent.sequence` is the ordering cursor of the complete tenant/space ledger. A view
+usually filters that ledger by event type and subject, so gaps in this global cursor do not prove
+that subject events are missing. Event sources that can guarantee contiguous per-subject ordering
+may also provide `subjectSequence`; only that explicit sequence is used for missing-event warnings.
+
 ## Portability boundary
 
 The repository Boundary Guard scans source and packed artifacts and fails CI if any of these leak in:

package/dist/adapters/index.cjs

@@ -1,28 +1,40 @@
 'use strict';
 
-var chunkNPVIFZQV_cjs = require('../chunk-NPVIFZQV.cjs');
+var chunkN2BBUKCX_cjs = require('../chunk-N2BBUKCX.cjs');
 
 
 
 Object.defineProperty(exports, "AdapterRegistry", {
   enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.AdapterRegistry; }
+  get: function () { return chunkN2BBUKCX_cjs.AdapterRegistry; }
 });
 Object.defineProperty(exports, "MissingAdapterRegistrationError", {
   enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.MissingAdapterRegistrationError; }
+  get: function () { return chunkN2BBUKCX_cjs.MissingAdapterRegistrationError; }
+});
+Object.defineProperty(exports, "assertAdapterOutcomeConsistency", {
+  enumerable: true,
+  get: function () { return chunkN2BBUKCX_cjs.assertAdapterOutcomeConsistency; }
+});
+Object.defineProperty(exports, "classifyAdapterOutcome", {
+  enumerable: true,
+  get: function () { return chunkN2BBUKCX_cjs.classifyAdapterOutcome; }
 });
 Object.defineProperty(exports, "executeWithAdapterRetry", {
   enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.executeWithAdapterRetry; }
+  get: function () { return chunkN2BBUKCX_cjs.executeWithAdapterRetry; }
 });
 Object.defineProperty(exports, "getRetryDelayMs", {
   enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.getRetryDelayMs; }
+  get: function () { return chunkN2BBUKCX_cjs.getRetryDelayMs; }
 });
 Object.defineProperty(exports, "resolveAdapterRetryPolicy", {
   enumerable: true,
-  get: function () { return chunkNPVIFZQV_cjs.resolveAdapterRetryPolicy; }
+  get: function () { return chunkN2BBUKCX_cjs.resolveAdapterRetryPolicy; }
+});
+Object.defineProperty(exports, "shouldRetryAdapterOutcome", {
+  enumerable: true,
+  get: function () { return chunkN2BBUKCX_cjs.shouldRetryAdapterOutcome; }
 });
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map

package/dist/adapters/index.d.cts

@@ -7,11 +7,51 @@ interface AdapterExecutionContext {
     causationId?: string;
     attempt: number;
     maxAttempts: number;
+    /** Epoch-millis deadline after which the adapter should abandon the call. */
+    deadlineMs?: number;
+    /** Set by the host when the invocation has been cancelled; adapters should stop work. */
+    cancelled?: boolean;
+    /** Non-secret reason the invocation was cancelled. */
+    cancellationReason?: string;
+    /**
+     * AbortSignal the host aborts when the deadline expires or the invocation is
+     * cancelled. Adapters should propagate this to underlying HTTP/database
+     * clients so in-flight work is abandoned rather than left dangling.
+     */
+    signal?: AbortSignal;
+}
+/**
+ * Additive classification of an adapter outcome so the retry layer can
+ * distinguish retryable transient failures from permanent rejections,
+ * timeouts, and ambiguous results that require manual reconciliation.
+ *
+ * When `outcome` is absent on an {@link AdapterExecutionResult}, the retry
+ * layer treats a non-success result as `transient_failure` for backward
+ * compatibility.
+ */
+type AdapterOutcomeKind = "success" | "transient_failure" | "permanent_failure" | "timeout" | "ambiguous";
+/**
+ * Durable, non-secret evidence attached to a classified adapter outcome.
+ * Used by the host to record reconciliation evidence when an adapter returns
+ * an ambiguous result whose external effect may or may not have been applied.
+ */
+interface AdapterOutcomeEvidence {
+    kind: AdapterOutcomeKind;
+    reason?: string;
+    /** Opaque, non-secret reference to external operation state for reconciliation. */
+    externalReference?: string;
+    /** Whether the external effect may have been applied (true for ambiguous/timeout). */
+    effectMayHaveApplied?: boolean;
+    observedAt: Date | string;
 }
 interface AdapterExecutionResult {
     success: boolean;
     correlationId?: string;
     error?: string;
+    /** Additive outcome classification. Omitted = infer from `success`. */
+    outcome?: AdapterOutcomeKind;
+    /** Durable evidence for ambiguous or timeout outcomes requiring reconciliation. */
+    outcomeEvidence?: AdapterOutcomeEvidence;
 }
 type AdapterExecutor = (input: Record<string, unknown>, context: AdapterExecutionContext) => Promise<AdapterExecutionResult>;
 interface AdapterRetryPolicy {
@@ -64,6 +104,20 @@ interface ExecuteWithRetryOptions<T> {
     execute: (attempt: number, maxAttempts: number) => Promise<T>;
     isSuccessful: (result: T) => boolean;
     getError: (result: T) => string | undefined;
+    /**
+     * Optional outcome classifier. When provided, the retry layer retries only
+     * `transient_failure` outcomes (and only when the policy is idempotent).
+     * `permanent_failure`, `timeout`, and `ambiguous` outcomes are never retried.
+     * When omitted, all non-success results are treated as transient (backward compatible).
+     */
+    classifyOutcome?: (result: T) => AdapterOutcomeKind;
+    /**
+     * Optional classifier for errors thrown by the execute callback (not returned
+     * as results). When provided, the retry layer retries only `transient_failure`
+     * classifications. When omitted, thrown errors are never retried — the caller
+     * must explicitly opt into retrying a thrown failure by classifying it.
+     */
+    classifyThrownError?: (error: unknown) => AdapterOutcomeKind;
     sleep?: (delayMs: number) => Promise<void>;
     onAttempt?: (attempt: AdapterAttempt<T>) => Promise<void> | void;
 }
@@ -78,6 +132,27 @@ declare class AdapterRegistry {
 }
 declare function resolveAdapterRetryPolicy(policy: AdapterRetryPolicy | undefined, defaultIdempotent: boolean): ResolvedAdapterRetryPolicy;
 declare function getRetryDelayMs(attempt: number, policy: ResolvedAdapterRetryPolicy): number;
+/**
+ * Classify an {@link AdapterExecutionResult} into an {@link AdapterOutcomeKind}.
+ * When `outcome` is explicitly set, it is returned directly, after rejecting a
+ * contradictory result where `success` is true but the outcome is non-success.
+ * Otherwise a successful result maps to `success` and a failed result maps to
+ * `transient_failure` (the historical default).
+ */
+declare function classifyAdapterOutcome(result: AdapterExecutionResult): AdapterOutcomeKind;
+/**
+ * Determine whether an outcome kind is retryable. Only `transient_failure`
+ * is retryable, and only when the adapter policy is idempotent. Permanent
+ * failures, timeouts, and ambiguous outcomes are never retried.
+ */
+declare function shouldRetryAdapterOutcome(kind: AdapterOutcomeKind, idempotent: boolean): boolean;
+/**
+ * Reject a contradictory adapter result where `success` is true but the
+ * explicit `outcome` is a non-success kind. A successful result claiming an
+ * ambiguous, permanent, timeout, or transient outcome is a programming
+ * error — the adapter cannot have both succeeded and require reconciliation.
+ */
+declare function assertAdapterOutcomeConsistency(result: AdapterExecutionResult): void;
 declare function executeWithAdapterRetry<T>(options: ExecuteWithRetryOptions<T>): Promise<T>;
 
-export { type AdapterAttempt, type AdapterCircuitBreakerConfig, type AdapterExecutionContext, type AdapterExecutionResult, type AdapterExecutor, type AdapterImplementation, AdapterRegistry, type AdapterRetryPolicy, type ExecuteWithRetryOptions, MissingAdapterRegistrationError, type ResolvedAdapterRetryPolicy, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy };
+export { type AdapterAttempt, type AdapterCircuitBreakerConfig, type AdapterExecutionContext, type AdapterExecutionResult, type AdapterExecutor, type AdapterImplementation, type AdapterOutcomeEvidence, type AdapterOutcomeKind, AdapterRegistry, type AdapterRetryPolicy, type ExecuteWithRetryOptions, MissingAdapterRegistrationError, type ResolvedAdapterRetryPolicy, assertAdapterOutcomeConsistency, classifyAdapterOutcome, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy, shouldRetryAdapterOutcome };

package/dist/adapters/index.d.ts

@@ -7,11 +7,51 @@ interface AdapterExecutionContext {
     causationId?: string;
     attempt: number;
     maxAttempts: number;
+    /** Epoch-millis deadline after which the adapter should abandon the call. */
+    deadlineMs?: number;
+    /** Set by the host when the invocation has been cancelled; adapters should stop work. */
+    cancelled?: boolean;
+    /** Non-secret reason the invocation was cancelled. */
+    cancellationReason?: string;
+    /**
+     * AbortSignal the host aborts when the deadline expires or the invocation is
+     * cancelled. Adapters should propagate this to underlying HTTP/database
+     * clients so in-flight work is abandoned rather than left dangling.
+     */
+    signal?: AbortSignal;
+}
+/**
+ * Additive classification of an adapter outcome so the retry layer can
+ * distinguish retryable transient failures from permanent rejections,
+ * timeouts, and ambiguous results that require manual reconciliation.
+ *
+ * When `outcome` is absent on an {@link AdapterExecutionResult}, the retry
+ * layer treats a non-success result as `transient_failure` for backward
+ * compatibility.
+ */
+type AdapterOutcomeKind = "success" | "transient_failure" | "permanent_failure" | "timeout" | "ambiguous";
+/**
+ * Durable, non-secret evidence attached to a classified adapter outcome.
+ * Used by the host to record reconciliation evidence when an adapter returns
+ * an ambiguous result whose external effect may or may not have been applied.
+ */
+interface AdapterOutcomeEvidence {
+    kind: AdapterOutcomeKind;
+    reason?: string;
+    /** Opaque, non-secret reference to external operation state for reconciliation. */
+    externalReference?: string;
+    /** Whether the external effect may have been applied (true for ambiguous/timeout). */
+    effectMayHaveApplied?: boolean;
+    observedAt: Date | string;
 }
 interface AdapterExecutionResult {
     success: boolean;
     correlationId?: string;
     error?: string;
+    /** Additive outcome classification. Omitted = infer from `success`. */
+    outcome?: AdapterOutcomeKind;
+    /** Durable evidence for ambiguous or timeout outcomes requiring reconciliation. */
+    outcomeEvidence?: AdapterOutcomeEvidence;
 }
 type AdapterExecutor = (input: Record<string, unknown>, context: AdapterExecutionContext) => Promise<AdapterExecutionResult>;
 interface AdapterRetryPolicy {
@@ -64,6 +104,20 @@ interface ExecuteWithRetryOptions<T> {
     execute: (attempt: number, maxAttempts: number) => Promise<T>;
     isSuccessful: (result: T) => boolean;
     getError: (result: T) => string | undefined;
+    /**
+     * Optional outcome classifier. When provided, the retry layer retries only
+     * `transient_failure` outcomes (and only when the policy is idempotent).
+     * `permanent_failure`, `timeout`, and `ambiguous` outcomes are never retried.
+     * When omitted, all non-success results are treated as transient (backward compatible).
+     */
+    classifyOutcome?: (result: T) => AdapterOutcomeKind;
+    /**
+     * Optional classifier for errors thrown by the execute callback (not returned
+     * as results). When provided, the retry layer retries only `transient_failure`
+     * classifications. When omitted, thrown errors are never retried — the caller
+     * must explicitly opt into retrying a thrown failure by classifying it.
+     */
+    classifyThrownError?: (error: unknown) => AdapterOutcomeKind;
     sleep?: (delayMs: number) => Promise<void>;
     onAttempt?: (attempt: AdapterAttempt<T>) => Promise<void> | void;
 }
@@ -78,6 +132,27 @@ declare class AdapterRegistry {
 }
 declare function resolveAdapterRetryPolicy(policy: AdapterRetryPolicy | undefined, defaultIdempotent: boolean): ResolvedAdapterRetryPolicy;
 declare function getRetryDelayMs(attempt: number, policy: ResolvedAdapterRetryPolicy): number;
+/**
+ * Classify an {@link AdapterExecutionResult} into an {@link AdapterOutcomeKind}.
+ * When `outcome` is explicitly set, it is returned directly, after rejecting a
+ * contradictory result where `success` is true but the outcome is non-success.
+ * Otherwise a successful result maps to `success` and a failed result maps to
+ * `transient_failure` (the historical default).
+ */
+declare function classifyAdapterOutcome(result: AdapterExecutionResult): AdapterOutcomeKind;
+/**
+ * Determine whether an outcome kind is retryable. Only `transient_failure`
+ * is retryable, and only when the adapter policy is idempotent. Permanent
+ * failures, timeouts, and ambiguous outcomes are never retried.
+ */
+declare function shouldRetryAdapterOutcome(kind: AdapterOutcomeKind, idempotent: boolean): boolean;
+/**
+ * Reject a contradictory adapter result where `success` is true but the
+ * explicit `outcome` is a non-success kind. A successful result claiming an
+ * ambiguous, permanent, timeout, or transient outcome is a programming
+ * error — the adapter cannot have both succeeded and require reconciliation.
+ */
+declare function assertAdapterOutcomeConsistency(result: AdapterExecutionResult): void;
 declare function executeWithAdapterRetry<T>(options: ExecuteWithRetryOptions<T>): Promise<T>;
 
-export { type AdapterAttempt, type AdapterCircuitBreakerConfig, type AdapterExecutionContext, type AdapterExecutionResult, type AdapterExecutor, type AdapterImplementation, AdapterRegistry, type AdapterRetryPolicy, type ExecuteWithRetryOptions, MissingAdapterRegistrationError, type ResolvedAdapterRetryPolicy, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy };
+export { type AdapterAttempt, type AdapterCircuitBreakerConfig, type AdapterExecutionContext, type AdapterExecutionResult, type AdapterExecutor, type AdapterImplementation, type AdapterOutcomeEvidence, type AdapterOutcomeKind, AdapterRegistry, type AdapterRetryPolicy, type ExecuteWithRetryOptions, MissingAdapterRegistrationError, type ResolvedAdapterRetryPolicy, assertAdapterOutcomeConsistency, classifyAdapterOutcome, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy, shouldRetryAdapterOutcome };

package/dist/adapters/index.js

@@ -1,3 +1,3 @@
-export { AdapterRegistry, MissingAdapterRegistrationError, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy } from '../chunk-3ZW5USXF.js';
+export { AdapterRegistry, MissingAdapterRegistrationError, assertAdapterOutcomeConsistency, classifyAdapterOutcome, executeWithAdapterRetry, getRetryDelayMs, resolveAdapterRetryPolicy, shouldRetryAdapterOutcome } from '../chunk-DTY3CHQZ.js';
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/{chunk-YZKUEC2J.cjs → chunk-3BGFHSSK.cjs}

@@ -1,6 +1,6 @@
 'use strict';
 
-var chunkNPVIFZQV_cjs = require('./chunk-NPVIFZQV.cjs');
+var chunkN2BBUKCX_cjs = require('./chunk-N2BBUKCX.cjs');
 
 // testing/index.ts
 function createFakeActionContext(options = {}) {
@@ -17,7 +17,7 @@ function createFakeActionContext(options = {}) {
   };
 }
 function createInMemoryAdapterRegistry() {
-  return new chunkNPVIFZQV_cjs.AdapterRegistry();
+  return new chunkN2BBUKCX_cjs.AdapterRegistry();
 }
 function createDeterministicIdFactory(prefix = "test") {
   let sequence = 0;
@@ -27,5 +27,5 @@ function createDeterministicIdFactory(prefix = "test") {
 exports.createDeterministicIdFactory = createDeterministicIdFactory;
 exports.createFakeActionContext = createFakeActionContext;
 exports.createInMemoryAdapterRegistry = createInMemoryAdapterRegistry;
-//# sourceMappingURL=chunk-YZKUEC2J.cjs.map
-//# sourceMappingURL=chunk-YZKUEC2J.cjs.map
+//# sourceMappingURL=chunk-3BGFHSSK.cjs.map
+//# sourceMappingURL=chunk-3BGFHSSK.cjs.map

package/dist/{chunk-YZKUEC2J.cjs.map → chunk-3BGFHSSK.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../testing/index.ts"],"names":["AdapterRegistry"],"mappings":";;;;;AAeO,SAAS,uBAAA,CACf,OAAA,GAAyC,EAAC,EACrB;AACrB,EAAA,OAAO;AAAA,IACN,kBAAA,EAAoB,QAAQ,kBAAA,IAAsB,UAAA;AAAA,IAClD,QAAA,EAAU,QAAQ,QAAA,IAAY,aAAA;AAAA,IAC9B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,SAAA,EAAW,QAAQ,SAAA,IAAa,QAAA;AAAA,IAChC,aAAA,EAAe,QAAQ,aAAA,IAAiB,WAAA;AAAA,IACxC,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,EAAA,EAAI,OAAA,CAAQ,EAAA,IAAO,EAAC;AAAA,IACpB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY;AAAC,GAChC;AACD;AAEO,SAAS,6BAAA,GAAiD;AAChE,EAAA,OAAO,IAAIA,iCAAA,EAAgB;AAC5B;AAEO,SAAS,4BAAA,CAA6B,SAAS,MAAA,EAAsB;AAC3E,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,OAAO,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAC9D","file":"chunk-YZKUEC2J.cjs","sourcesContent":["import { AdapterRegistry } from \"../adapters\";\nimport type { ActionContext, ActorType } from \"../actions\";\n\nexport interface FakeActionContextOptions<TDb = Record<string, never>> {\n\tactionInvocationId?: string;\n\ttenantId?: string;\n\tspaceId?: string;\n\tactorId?: string;\n\tactorType?: ActorType;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tdb?: TDb;\n\tservices?: Record<string, unknown>;\n}\n\nexport function createFakeActionContext<TDb = Record<string, never>>(\n\toptions: FakeActionContextOptions<TDb> = {},\n): ActionContext<TDb> {\n\treturn {\n\t\tactionInvocationId: options.actionInvocationId ?? \"act_test\",\n\t\ttenantId: options.tenantId ?? \"tenant-test\",\n\t\tspaceId: options.spaceId ?? \"space-test\",\n\t\tactorId: options.actorId ?? \"actor-test\",\n\t\tactorType: options.actorType ?? \"system\",\n\t\tcorrelationId: options.correlationId ?? \"corr-test\",\n\t\tcausationId: options.causationId,\n\t\tdb: options.db ?? ({} as TDb),\n\t\tservices: options.services ?? {},\n\t};\n}\n\nexport function createInMemoryAdapterRegistry(): AdapterRegistry {\n\treturn new AdapterRegistry();\n}\n\nexport function createDeterministicIdFactory(prefix = \"test\"): () => string {\n\tlet sequence = 0;\n\treturn () => `${prefix}_${String(++sequence).padStart(6, \"0\")}`;\n}\n"]}
+{"version":3,"sources":["../testing/index.ts"],"names":["AdapterRegistry"],"mappings":";;;;;AAeO,SAAS,uBAAA,CACf,OAAA,GAAyC,EAAC,EACrB;AACrB,EAAA,OAAO;AAAA,IACN,kBAAA,EAAoB,QAAQ,kBAAA,IAAsB,UAAA;AAAA,IAClD,QAAA,EAAU,QAAQ,QAAA,IAAY,aAAA;AAAA,IAC9B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,OAAA,EAAS,QAAQ,OAAA,IAAW,YAAA;AAAA,IAC5B,SAAA,EAAW,QAAQ,SAAA,IAAa,QAAA;AAAA,IAChC,aAAA,EAAe,QAAQ,aAAA,IAAiB,WAAA;AAAA,IACxC,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,EAAA,EAAI,OAAA,CAAQ,EAAA,IAAO,EAAC;AAAA,IACpB,QAAA,EAAU,OAAA,CAAQ,QAAA,IAAY;AAAC,GAChC;AACD;AAEO,SAAS,6BAAA,GAAiD;AAChE,EAAA,OAAO,IAAIA,iCAAA,EAAgB;AAC5B;AAEO,SAAS,4BAAA,CAA6B,SAAS,MAAA,EAAsB;AAC3E,EAAA,IAAI,QAAA,GAAW,CAAA;AACf,EAAA,OAAO,MAAM,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,MAAA,CAAO,EAAE,QAAQ,CAAA,CAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAA;AAC9D","file":"chunk-3BGFHSSK.cjs","sourcesContent":["import { AdapterRegistry } from \"../adapters\";\nimport type { ActionContext, ActorType } from \"../actions\";\n\nexport interface FakeActionContextOptions<TDb = Record<string, never>> {\n\tactionInvocationId?: string;\n\ttenantId?: string;\n\tspaceId?: string;\n\tactorId?: string;\n\tactorType?: ActorType;\n\tcorrelationId?: string;\n\tcausationId?: string;\n\tdb?: TDb;\n\tservices?: Record<string, unknown>;\n}\n\nexport function createFakeActionContext<TDb = Record<string, never>>(\n\toptions: FakeActionContextOptions<TDb> = {},\n): ActionContext<TDb> {\n\treturn {\n\t\tactionInvocationId: options.actionInvocationId ?? \"act_test\",\n\t\ttenantId: options.tenantId ?? \"tenant-test\",\n\t\tspaceId: options.spaceId ?? \"space-test\",\n\t\tactorId: options.actorId ?? \"actor-test\",\n\t\tactorType: options.actorType ?? \"system\",\n\t\tcorrelationId: options.correlationId ?? \"corr-test\",\n\t\tcausationId: options.causationId,\n\t\tdb: options.db ?? ({} as TDb),\n\t\tservices: options.services ?? {},\n\t};\n}\n\nexport function createInMemoryAdapterRegistry(): AdapterRegistry {\n\treturn new AdapterRegistry();\n}\n\nexport function createDeterministicIdFactory(prefix = \"test\"): () => string {\n\tlet sequence = 0;\n\treturn () => `${prefix}_${String(++sequence).padStart(6, \"0\")}`;\n}\n"]}

package/dist/{chunk-35LADVKK.cjs → chunk-3UBX7KQM.cjs}

@@ -1,8 +1,8 @@
 'use strict';
 
-var chunkCBY6GRJP_cjs = require('./chunk-CBY6GRJP.cjs');
-var chunkM5FGWXT3_cjs = require('./chunk-M5FGWXT3.cjs');
-var chunk53VEUYCS_cjs = require('./chunk-53VEUYCS.cjs');
+var chunkIFW43ELT_cjs = require('./chunk-IFW43ELT.cjs');
+var chunkCXR6KEKQ_cjs = require('./chunk-CXR6KEKQ.cjs');
+var chunkLDPBQ72C_cjs = require('./chunk-LDPBQ72C.cjs');
 
 // modules/index.ts
 function getModuleDependencyNamespace(dependency) {
@@ -36,7 +36,7 @@ function createModuleRegistry(modules = []) {
     const definition = machine;
     return [definition.entityType, definition];
   })));
-  const views = new Map(orderedModules.flatMap((module) => (module.views ?? []).map((view) => [chunkM5FGWXT3_cjs.viewContractKey(view), view])));
+  const views = new Map(orderedModules.flatMap((module) => (module.views ?? []).map((view) => [chunkCXR6KEKQ_cjs.viewContractKey(view), view])));
   return {
     modules: registered,
     orderedModules,
@@ -74,7 +74,7 @@ function qualifiedObjectType(namespace, type) {
 function validateObjectDefinition(objectType, namespace, context) {
   if (typeof objectType === "string") return;
   if (objectType.schema !== void 0) {
-    chunkCBY6GRJP_cjs.assertPortableJsonSchema(objectType.schema, `Module "${namespace}" object "${objectType.type}" schema`);
+    chunkIFW43ELT_cjs.assertPortableJsonSchema(objectType.schema, `Module "${namespace}" object "${objectType.type}" schema`);
   }
   if (objectType.semantics !== void 0) {
     assertJsonValue(objectType.semantics, `Module "${namespace}" object "${objectType.type}" semantics`);
@@ -112,6 +112,56 @@ function validateObjectDefinition(objectType, namespace, context) {
     }
   }
 }
+function validateCapabilityWorkflows(module, context) {
+  const workflows = module.capability?.workflows ?? [];
+  const actionsById = new Map((module.actions ?? []).map((action) => [action.actionId, action]));
+  const names = /* @__PURE__ */ new Set();
+  for (const workflow of workflows) {
+    if (!/^[A-Za-z][A-Za-z0-9_-]*$/.test(workflow.name)) {
+      throw new Error(`Module "${module.namespace}" declares invalid workflow name "${workflow.name}".`);
+    }
+    if (names.has(workflow.name)) {
+      throw new Error(`Module "${module.namespace}" declares duplicate workflow "${workflow.name}".`);
+    }
+    names.add(workflow.name);
+    if (!/^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)*$/.test(workflow.taskQueue)) {
+      throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" declares invalid task queue "${workflow.taskQueue}".`);
+    }
+    if (workflow.startedBy !== void 0) {
+      const known = context.plannedEventTypes?.has(workflow.startedBy) ?? (module.eventTypes ?? []).some((eventType) => getEventTypeName(eventType) === workflow.startedBy);
+      if (!known) {
+        throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" is started by unknown event type "${workflow.startedBy}".`);
+      }
+    }
+    const timerNames = /* @__PURE__ */ new Set();
+    for (const timer of workflow.timers ?? []) {
+      if (!timer.name.trim() || !timer.configKey.trim()) {
+        throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" has a timer without a name or configKey.`);
+      }
+      if (timerNames.has(timer.name)) {
+        throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" declares duplicate timer "${timer.name}".`);
+      }
+      timerNames.add(timer.name);
+    }
+    const steps = /* @__PURE__ */ new Set();
+    for (const compensation of workflow.compensations ?? []) {
+      if (!compensation.step.trim()) {
+        throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" has a compensation without a step.`);
+      }
+      if (steps.has(compensation.step)) {
+        throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" declares duplicate compensation for step "${compensation.step}".`);
+      }
+      steps.add(compensation.step);
+      const compensatingAction = actionsById.get(compensation.actionId);
+      if (!compensatingAction) {
+        throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" compensates step "${compensation.step}" with unknown action "${compensation.actionId}".`);
+      }
+      if (!compensatingAction.idempotent || compensatingAction.execution?.idempotency === "prohibited") {
+        throw new Error(`Module "${module.namespace}" workflow "${workflow.name}" compensates step "${compensation.step}" with non-idempotent action "${compensation.actionId}"; a reversal must be safely repeatable.`);
+      }
+    }
+  }
+}
 function validateManifest(module, context = {}) {
   validateModuleNamespace(module.namespace);
   const dependencies = (module.dependencies ?? []).map(getModuleDependencyNamespace);
@@ -129,13 +179,14 @@ function validateManifest(module, context = {}) {
     for (const port of module.capability.requirements?.ports ?? []) {
       if (!/^[a-z][a-z0-9-]*$/.test(port.name)) throw new Error(`Module "${module.namespace}" capability has invalid port requirement "${port.name}".`);
     }
+    validateCapabilityWorkflows(module, context);
   }
-  for (const eventType of module.eventTypes ?? []) if (typeof eventType !== "string" && eventType.schema) chunkCBY6GRJP_cjs.assertPortableJsonSchema(eventType.schema, `Event "${eventType.eventType}" schema`);
+  for (const eventType of module.eventTypes ?? []) if (typeof eventType !== "string" && eventType.schema) chunkIFW43ELT_cjs.assertPortableJsonSchema(eventType.schema, `Event "${eventType.eventType}" schema`);
   for (const action of module.actions ?? []) {
     if (action.execution?.idempotency === "required" && !action.idempotent) throw new Error(`Action "${action.actionId}" requires idempotency but is not declared idempotent.`);
     if (action.execution?.connectivity === "offline-capturable" && action.execution.idempotency === "prohibited") throw new Error(`Offline action "${action.actionId}" cannot prohibit idempotency.`);
   }
-  for (const view of module.views ?? []) if (view.usage?.collection?.filterSchema) chunkCBY6GRJP_cjs.assertPortableJsonSchema(view.usage.collection.filterSchema, `View "${view.name}" filter schema`);
+  for (const view of module.views ?? []) if (view.usage?.collection?.filterSchema) chunkIFW43ELT_cjs.assertPortableJsonSchema(view.usage.collection.filterSchema, `View "${view.name}" filter schema`);
   for (const dependency of dependencies) {
     validateModuleNamespace(dependency);
     if (dependency === module.namespace) {
@@ -173,14 +224,14 @@ function validateManifest(module, context = {}) {
     } catch {
       parameterSchema = void 0;
     }
-    if (parameterSchema !== void 0) chunkCBY6GRJP_cjs.assertPortableJsonSchema(parameterSchema, `Action "${action.actionId}" parameters`);
+    if (parameterSchema !== void 0) chunkIFW43ELT_cjs.assertPortableJsonSchema(parameterSchema, `Action "${action.actionId}" parameters`);
     let resultSchema;
     try {
       resultSchema = action.resultSchema?.toJSONSchema?.();
     } catch {
       resultSchema = void 0;
     }
-    if (resultSchema !== void 0) chunkCBY6GRJP_cjs.assertPortableJsonSchema(resultSchema, `Action "${action.actionId}" result`);
+    if (resultSchema !== void 0) chunkIFW43ELT_cjs.assertPortableJsonSchema(resultSchema, `Action "${action.actionId}" result`);
     if (!/^[a-z][a-z0-9-]*\.[a-z][a-z0-9_]*$/.test(action.actionId)) {
       throw new Error(`Invalid action ID: ${action.actionId}`);
     }
@@ -209,7 +260,8 @@ function validateManifest(module, context = {}) {
     const key = `${view.name}@${view.version}`;
     if (viewKeys.has(key)) throw new Error(`Module "${module.namespace}" has duplicate view contract "${key}".`);
     viewKeys.add(key);
-    chunkCBY6GRJP_cjs.assertPortableJsonSchema(view.shape, `View "${key}" shape`);
+    chunkIFW43ELT_cjs.assertPortableJsonSchema(view.shape, `View "${key}" shape`);
+    if (view.parameterSchema !== void 0) chunkIFW43ELT_cjs.assertPortableJsonSchema(view.parameterSchema, `View "${key}" parameters`);
     if (!Number.isInteger(view.snapshotVersion) || view.snapshotVersion < 1) {
       throw new Error(`View "${key}" snapshotVersion must be a positive integer.`);
     }
@@ -304,7 +356,7 @@ function validateAndOrderFabricModules(modules) {
   const plannedEventTypes = new Set(
     modules.flatMap((module) => (module.eventTypes ?? []).map(getEventTypeName))
   );
-  for (const eventType of chunk53VEUYCS_cjs.createEventContractRegistry().eventTypes()) plannedEventTypes.add(eventType);
+  for (const eventType of chunkLDPBQ72C_cjs.createEventContractRegistry().eventTypes()) plannedEventTypes.add(eventType);
   const availableObjectTypes = /* @__PURE__ */ new Set([
     ...modules.flatMap(
       (module) => (module.objectTypes ?? []).map((objectType) => qualifiedObjectType(module.namespace, getObjectTypeName(objectType)))
@@ -331,5 +383,5 @@ exports.registerFabricModule = registerFabricModule;
 exports.registerFabricModules = registerFabricModules;
 exports.validateAndOrderFabricModules = validateAndOrderFabricModules;
 exports.validateModuleNamespace = validateModuleNamespace;
-//# sourceMappingURL=chunk-35LADVKK.cjs.map
-//# sourceMappingURL=chunk-35LADVKK.cjs.map
+//# sourceMappingURL=chunk-3UBX7KQM.cjs.map
+//# sourceMappingURL=chunk-3UBX7KQM.cjs.map