@fabricorg/platform 1.12.0 → 1.13.0

package/CHANGELOG.md

@@ -1,5 +1,38 @@
 # @fabricorg/platform
 
+## 1.13.0
+
+### Minor Changes
+
+- 749c507: Add host-owned staged descendant invocations. Actions declare an allowlist and return typed child
+  requests; Platform Host validates and redacts them atomically, releases them only after parent
+  completion, and dispatches them through fresh entitlement, authorization, admission, runtime
+  evidence, policy, and HITL decisions.
+
+  PostgreSQL migration 11 adds the staged-invocation ledger and caller-unforgeable child-origin unique
+  index. Child identity is a Host-only parent-invocation/stage-key origin. Child creation is
+  atomically fenced on the stage's pending status, lease owner, lease token, and unexpired lease;
+  PostgreSQL locks that stage row `FOR SHARE` while the fenced insert is in flight.
+
+  Each attempt settles a stage through one sequence. It first looks the child up by origin: a child
+  created by an earlier attempt is handed to the dispatcher again with its stable workflow ID while it
+  remains pending, without pre-submission checks or repeated governance, even after a deploy changes
+  the child's schema. Otherwise Host submits the child. When that submission did not itself return
+  the child (a failed check, a refusal, an error, or a timeout), Host rotates the lease token through
+  the store operation `rotateStagedInvocationLease` before an authoritative lookup, so the attempt's
+  own timed-out submission can no longer create the child. A stage is rejected only when that lookup
+  finds no child, and a dead-lettered stage records the child ID whenever the attempt found or created
+  a child. A stage becomes dispatched only after confirmed handoff, when no dispatcher is configured,
+  or when the child has already left pending. A failed child lookup settles the stage for retry and
+  does not dead-letter it. Settlements are compare-and-set on the lease owner and current token and
+  keep a child ID recorded earlier. A store error on one stage is reported through the sweep's
+  `onError` option (the Platform worker passes its own) and does not stop the rest of the batch.
+  Handoff failures retry after a constant one-second delay by default; callers provide `retryDelayMs`
+  for backoff. Public entitlement and authorization refusals now expose `SubmissionRefusalError` with
+  stable `code: "ACTION_SUBMISSION_REFUSED"`. The child inherits the parent's actor type: a
+  natural-person parent therefore does not enter agent HITL, while an agent parent follows the normal
+  agent approval route.
+
 ## 1.12.0
 
 ### Minor Changes

package/README.md

@@ -88,6 +88,21 @@ const registry = createModuleRegistry([myModule]);
 
 The platform never auto-loads a module. The host app composes an instance-scoped registry and injects it into its hosts. Experience roles, slots, action intents, and display rendering live in `@fabricorg/experience-contracts`, carried through the namespaced `fabric.experience/v1` extension.
 
+## Staged descendant invocations
+
+An action may declare `stagesInvocations` as the child action IDs it is allowed to stage. Its
+handler returns requests through `ActionResult.stagedInvocations`; an `after_adapters` finalizer may
+add requests through `ActionFinalizationResult.stagedInvocations`. Each request contains only a
+stable key, an action ID, and parameters. Actor, tenant, space, correlation, causation,
+authorization, provenance, and child identity remain Host-owned.
+
+Module registration rejects unknown targets, self-targets, capture-authority targets, and targets
+in another module unless that module is a declared dependency. A staged child is not delegated
+under the parent's authorization decision: dispatch submits it through the current registered
+action, entitlement, authorization, admission, runtime-evidence, and dispatcher pipeline. See the
+[`@fabricorg/platform-host` staging contract](../platform-host/README.md#staged-descendant-invocations)
+for transaction, recovery, release, and limit semantics.
+
 ## Exporting a module manifest
 
 Downstream tooling — semantics exporters, docs generators, tool generators — often needs a module's ontology as data rather than live code. `@fabricorg/platform/manifest` exports a stable, JSON-serializable, versioned description of any `FabricModule`:

package/dist/actions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\treturn handler ? handler(ctx, params) : { success: true, data: {} };\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";;AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AAyIA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,OAAO,UAAU,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;EACnE;CAAE;AACH;;AAuBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAmJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\n/** A descendant invocation the Host durably stages with its parent mutation. */\nexport interface StagedInvocationRequest {\n\t/** Stable identity within one parent invocation. */\n\treadonly key: string;\n\treadonly actionId: ActionId;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n\t/** Host-owned descendants released only after this invocation completes. */\n\tstagedInvocations?: readonly StagedInvocationRequest[];\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n\t/** Additional descendants staged atomically with finalization and completion. */\n\treadonly stagedInvocations?: readonly StagedInvocationRequest[];\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\treturn handler ? handler(ctx, params) : { success: true, data: {} };\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Child action IDs this action is permitted to stage for post-completion dispatch. */\n\tstagesInvocations?: readonly ActionId[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";;AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AAqJA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,OAAO,UAAU,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;EACnE;CAAE;AACH;;AAuBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAqJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}

package/dist/actions/index.d.cts

@@ -107,10 +107,19 @@ export type ActionAdmissionDecision = {
  * answer other than `{ admitted: true }` refuses the submission.
  */
 export type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
+/** A descendant invocation the Host durably stages with its parent mutation. */
+export interface StagedInvocationRequest {
+  /** Stable identity within one parent invocation. */
+  readonly key: string;
+  readonly actionId: ActionId;
+  readonly parameters: Record<string, unknown>;
+}
 export interface ActionResult {
   success: boolean;
   data?: Record<string, unknown>;
   error?: string;
+  /** Host-owned descendants released only after this invocation completes. */
+  stagedInvocations?: readonly StagedInvocationRequest[];
 }
 export type ActionHandler<TDb = unknown> = (ctx: ActionContext<TDb>, params: unknown) => Promise<ActionResult>;
 export type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | {
@@ -146,6 +155,8 @@ export interface ActionFinalizationEvent {
 export interface ActionFinalizationResult {
   readonly events?: readonly ActionFinalizationEvent[];
   readonly resultPatch?: FinalizationRecord;
+  /** Additional descendants staged atomically with finalization and completion. */
+  readonly stagedInvocations?: readonly StagedInvocationRequest[];
 }
 export type ActionFinalizer<TDb = unknown> = (ctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput) => Promise<ActionFinalizationResult>;
 /** Validate declarations at registration and at dynamically resolved execution boundaries. */
@@ -208,6 +219,8 @@ export interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
   execution?: ActionExecutionContract;
   stateMachine?: ActionStateMachineBinding;
   adapterSteps?: AdapterStep[];
+  /** Child action IDs this action is permitted to stage for post-completion dispatch. */
+  stagesInvocations?: readonly ActionId[];
   /** Completion actions can attest only after all external adapter work succeeds. */
   eventPhase?: "before_adapters" | "after_adapters";
   /**

package/dist/actions/index.d.ts

@@ -107,10 +107,19 @@ export type ActionAdmissionDecision = {
  * answer other than `{ admitted: true }` refuses the submission.
  */
 export type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
+/** A descendant invocation the Host durably stages with its parent mutation. */
+export interface StagedInvocationRequest {
+  /** Stable identity within one parent invocation. */
+  readonly key: string;
+  readonly actionId: ActionId;
+  readonly parameters: Record<string, unknown>;
+}
 export interface ActionResult {
   success: boolean;
   data?: Record<string, unknown>;
   error?: string;
+  /** Host-owned descendants released only after this invocation completes. */
+  stagedInvocations?: readonly StagedInvocationRequest[];
 }
 export type ActionHandler<TDb = unknown> = (ctx: ActionContext<TDb>, params: unknown) => Promise<ActionResult>;
 export type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | {
@@ -146,6 +155,8 @@ export interface ActionFinalizationEvent {
 export interface ActionFinalizationResult {
   readonly events?: readonly ActionFinalizationEvent[];
   readonly resultPatch?: FinalizationRecord;
+  /** Additional descendants staged atomically with finalization and completion. */
+  readonly stagedInvocations?: readonly StagedInvocationRequest[];
 }
 export type ActionFinalizer<TDb = unknown> = (ctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput) => Promise<ActionFinalizationResult>;
 /** Validate declarations at registration and at dynamically resolved execution boundaries. */
@@ -208,6 +219,8 @@ export interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
   execution?: ActionExecutionContract;
   stateMachine?: ActionStateMachineBinding;
   adapterSteps?: AdapterStep[];
+  /** Child action IDs this action is permitted to stage for post-completion dispatch. */
+  stagesInvocations?: readonly ActionId[];
   /** Completion actions can attest only after all external adapter work succeeds. */
   eventPhase?: "before_adapters" | "after_adapters";
   /**

package/dist/actions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\treturn handler ? handler(ctx, params) : { success: true, data: {} };\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AAyIA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,OAAO,UAAU,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;EACnE;CAAE;AACH;;AAuBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAmJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}
+{"version":3,"file":"index.js","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\n/** A descendant invocation the Host durably stages with its parent mutation. */\nexport interface StagedInvocationRequest {\n\t/** Stable identity within one parent invocation. */\n\treadonly key: string;\n\treadonly actionId: ActionId;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n\t/** Host-owned descendants released only after this invocation completes. */\n\tstagedInvocations?: readonly StagedInvocationRequest[];\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n\t/** Additional descendants staged atomically with finalization and completion. */\n\treadonly stagedInvocations?: readonly StagedInvocationRequest[];\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\treturn handler ? handler(ctx, params) : { success: true, data: {} };\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Child action IDs this action is permitted to stage for post-completion dispatch. */\n\tstagesInvocations?: readonly ActionId[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AAqJA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,OAAO,UAAU,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;EACnE;CAAE;AACH;;AAuBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAqJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { n as assertSurfaceDeclaration, t as SurfaceDeclaration } from "./index-CIl1rYRv.cjs";
-import { ACTOR_TYPES, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterStep, AdapterStepRetryPolicy, AuthorityMoment, FabricRuntimeServices, FinalizationJson, FinalizationRecord, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, assertActionFinalization, assertActionId, assertActorType, assertAdapterStepDeadlines, createActionRegistry, defineFinalizingAction, isActorType } from "./actions/index.cjs";
+import { ACTOR_TYPES, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterStep, AdapterStepRetryPolicy, AuthorityMoment, FabricRuntimeServices, FinalizationJson, FinalizationRecord, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, assertActionFinalization, assertActionId, assertActorType, assertAdapterStepDeadlines, createActionRegistry, defineFinalizingAction, isActorType } from "./actions/index.cjs";
 import { AcceptedExternalOperation, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, ExecuteWithRetryOptions, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, MissingAdapterRegistrationError, ResolvedAdapterRetryPolicy, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, classifyAdapterOutcome, classifyCircuitBreakerOutcome, executeWithAdapterRetry, getRetryDelayMs, isAdapterCircuitOpenError, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome } from "./adapters/index.cjs";
 import { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from "./agent-hitl/index.cjs";
 import { a as ObjectTypeRegistry, c as assertPortableJsonSchema, i as JsonValue, l as createObjectTypeRegistry, n as JsonPrimitive, o as PortableJsonSchema, r as JsonSchemaValidationIssue, s as assertObjectType, t as FabricObjectType, u as validatePortableJson } from "./index-DZ4mnNb7.cjs";
@@ -15,4 +15,4 @@ import { C as AnonymizationPolicy, D as stableChecksum, E as FieldRedactor, S as
 import { ExecutionAttestation, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, GovernanceRuntimeEvidence, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, PolicyObligation, PolicyObligationStatus, ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from "./governance/index.cjs";
 import { FABRIC_ID_PREFIXES, FabricIdPrefix, createFabricId, isFabricId, parseFabricId } from "./ids/index.cjs";
 import { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from "./testing/index.cjs";
-export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };
+export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import { n as assertSurfaceDeclaration, t as SurfaceDeclaration } from "./index-CIl1rYRv.js";
-import { ACTOR_TYPES, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterStep, AdapterStepRetryPolicy, AuthorityMoment, FabricRuntimeServices, FinalizationJson, FinalizationRecord, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, assertActionFinalization, assertActionId, assertActorType, assertAdapterStepDeadlines, createActionRegistry, defineFinalizingAction, isActorType } from "./actions/index.js";
+import { ACTOR_TYPES, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterStep, AdapterStepRetryPolicy, AuthorityMoment, FabricRuntimeServices, FinalizationJson, FinalizationRecord, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, assertActionFinalization, assertActionId, assertActorType, assertAdapterStepDeadlines, createActionRegistry, defineFinalizingAction, isActorType } from "./actions/index.js";
 import { AcceptedExternalOperation, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, ExecuteWithRetryOptions, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, MissingAdapterRegistrationError, ResolvedAdapterRetryPolicy, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, classifyAdapterOutcome, classifyCircuitBreakerOutcome, executeWithAdapterRetry, getRetryDelayMs, isAdapterCircuitOpenError, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome } from "./adapters/index.js";
 import { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from "./agent-hitl/index.js";
 import { a as ObjectTypeRegistry, c as assertPortableJsonSchema, i as JsonValue, l as createObjectTypeRegistry, n as JsonPrimitive, o as PortableJsonSchema, r as JsonSchemaValidationIssue, s as assertObjectType, t as FabricObjectType, u as validatePortableJson } from "./index-DZ4mnNb7.js";
@@ -15,4 +15,4 @@ import { C as AnonymizationPolicy, D as stableChecksum, E as FieldRedactor, S as
 import { ExecutionAttestation, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, GovernanceRuntimeEvidence, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, PolicyObligation, PolicyObligationStatus, ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from "./governance/index.js";
 import { FABRIC_ID_PREFIXES, FabricIdPrefix, createFabricId, isFabricId, parseFabricId } from "./ids/index.js";
 import { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from "./testing/index.js";
-export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };
+export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };

package/dist/manifest/index.cjs

@@ -95,6 +95,7 @@ function exportAction(action) {
 	if (action.policies !== void 0) manifest.policies = [...action.policies];
 	if (action.requiredRoles !== void 0) manifest.requiredRoles = [...action.requiredRoles];
 	if (action.requiredPermissions !== void 0) manifest.requiredPermissions = [...action.requiredPermissions];
+	if (action.stagesInvocations !== void 0) manifest.stagesInvocations = [...action.stagesInvocations];
 	if (action.eventPhase !== void 0) manifest.eventPhase = action.eventPhase;
 	if (action.finalize !== void 0) manifest.finalization = { protocol: "atomic-after-adapters-v1" };
 	if (action.execution !== void 0) manifest.execution = cloneJson(action.execution);

package/dist/manifest/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":["getModuleDependencyNamespace","getObjectTypeName","getEventTypeName"],"sources":["../../manifest/index.ts"],"sourcesContent":["import { assertAdapterStepDeadlines } from \"../actions\";\nimport { assertSurfaceDeclaration, type SurfaceDeclaration } from \"../discovery\";\nimport type {\n\tActionExecutionContract,\n\tActionDefinition,\n\tAdapterStepRetryPolicy,\n\tSchemaValidator,\n} from \"../actions\";\nimport {\n\tgetEventTypeName,\n\tgetModuleDependencyNamespace,\n\tgetObjectTypeName,\n\ttype FabricModule,\n\ttype CapabilityMetadata,\n\ttype DeclarativeInvariant,\n\ttype ModuleDependency,\n\ttype ModuleDependencyInput,\n\ttype ObjectRelationDefinition,\n} from \"../modules\";\nimport type { JsonValue, PortableJsonSchema } from \"../objects\";\nimport type {\n\tDataPolicyDefinition,\n\tPolicyFallbackDefinition,\n\tPolicyKind,\n} from \"../policies\";\nimport type { StateDefinition, StateMachineDefinition } from \"../state-machines\";\nimport type { ViewContract } from \"../projections\";\n\n/**\n * Version of the module manifest contract. Bump when the serialized shape\n * changes in a way consumers must detect.\n */\nexport const MODULE_MANIFEST_VERSION = 2 as const;\n\nexport interface ModuleManifestObjectType {\n\ttype: string;\n\tdisplayName?: string;\n\tidPrefix?: string;\n\tschema?: PortableJsonSchema;\n\tsemantics?: Record<string, JsonValue>;\n\trelations?: ObjectRelationDefinition[];\n\tinvariants?: DeclarativeInvariant[];\n}\n\nexport interface ModuleManifestIdPrefix {\n\tprefix: string;\n\tname: string;\n}\n\nexport interface ModuleManifestEventType {\n\teventType: string;\n\tschemaVersion: number;\n\tdescription?: string;\n\tschema?: PortableJsonSchema;\n}\n\nexport interface ModuleManifestActionStateMachine {\n\tentityType: string;\n\t/** Present only when the binding declares a static target state. */\n\ttargetState?: string;\n}\n\nexport interface ModuleManifestAdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n}\n\nexport interface ModuleManifestAction extends SurfaceDeclaration {\n\tactionId: string;\n\tversion: number;\n\tkind: \"atomic\" | \"saga\";\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\temitsEvents: string[];\n\tpolicies?: string[];\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\tfinalization?: { protocol: \"atomic-after-adapters-v1\" };\n\texecution?: ActionExecutionContract;\n\t/**\n\t * JSON Schema for the action parameters, present only when the action's\n\t * `schema` validator implements {@link JsonSchemaExportableValidator}.\n\t */\n\tparameterSchema?: unknown;\n\tparameterSchemaFormat?: \"json-schema\";\n\tresultSchema?: unknown;\n\tresultSchemaFormat?: \"json-schema\";\n\tstateMachine?: ModuleManifestActionStateMachine;\n\tadapterSteps?: ModuleManifestAdapterStep[];\n}\n\nexport interface ModuleManifestCodePolicy {\n\ttype: \"code\";\n\tpolicyId: string;\n\tversion: number;\n\tpreviewSafe?: boolean;\n}\n\nexport interface ModuleManifestDataPolicy {\n\ttype: \"data\";\n\tpolicyId: string;\n\tpolicyVersion: number;\n\tkind: PolicyKind;\n\tdataDefinition?: DataPolicyDefinition;\n\tcodeEvaluatorPolicyId?: string;\n\tfallback?: PolicyFallbackDefinition;\n}\n\nexport type ModuleManifestPolicy = ModuleManifestCodePolicy | ModuleManifestDataPolicy;\n\nexport interface ModuleManifestStateMachineTransition {\n\tfrom: string;\n\tto: string;\n\tcausedByAction: string;\n\t/** `true` when the transition declares a guard function. The guard itself is never serialized. */\n\thasGuard: boolean;\n}\n\nexport interface ModuleManifestStateMachine {\n\tentityType: string;\n\t/** States in declaration order (`Object.values` order of the definition record). */\n\tstates: StateDefinition[];\n\ttransitions: ModuleManifestStateMachineTransition[];\n}\n\nexport interface ModuleManifestView extends SurfaceDeclaration {\n\tname: string;\n\tversion: string;\n\tshape: PortableJsonSchema;\n\tparameterSchema?: PortableJsonSchema;\n\tconsumes: Array<{ eventType: string; schemaVersions: number[] }>;\n\tscope: \"tenant-space\";\n\tsnapshotVersion: number;\n\tcompatibleSnapshotVersions?: number[];\n\tusage?: ViewContract[\"usage\"];\n}\n\n/**\n * Stable, JSON-serializable description of a {@link FabricModule}'s ontology:\n * object types, subject types, id prefixes, event types, actions, policies,\n * and state machines. Intended for downstream tooling (semantics exporters,\n * docs generators, tool generators) that cannot consume live module code.\n *\n * The manifest contains definitions only — never raw parameter values,\n * secrets, or runtime data. Function fields (`handler`, `evaluate`, `guard`,\n * dynamic `targetState`, adapter `getInput`) are never serialized.\n */\nexport interface ModuleManifest {\n\tmanifestVersion: typeof MODULE_MANIFEST_VERSION;\n\tnamespace: string;\n\tversion?: string;\n\tdisplayName?: string;\n\tdescription?: string;\n\tcapability?: CapabilityMetadata;\n\tdependencies: ModuleDependency[];\n\tobjectTypes: ModuleManifestObjectType[];\n\tsubjectTypes: string[];\n\tidPrefixes: ModuleManifestIdPrefix[];\n\teventTypes: ModuleManifestEventType[];\n\tactions: ModuleManifestAction[];\n\tpolicies: ModuleManifestPolicy[];\n\tstateMachines: ModuleManifestStateMachine[];\n\tviews: ModuleManifestView[];\n}\n\nexport interface ModuleManifestBundle {\n\tmanifestVersion: typeof MODULE_MANIFEST_VERSION;\n\t/** Manifests in the input module order. */\n\tmodules: ModuleManifest[];\n}\n\n/** Manifest v1 remains accepted by v2 readers; missing v2 fields normalize to absence. */\nexport type ModuleManifestObjectTypeV1 = Omit<\n\tModuleManifestObjectType,\n\t\"schema\" | \"semantics\" | \"relations\" | \"invariants\"\n>;\nexport type ModuleManifestActionV1 = Omit<\n\tModuleManifestAction,\n\t\"resultSchema\" | \"resultSchemaFormat\"\n>;\nexport type ModuleManifestV1 = Omit<\n\tModuleManifest,\n\t\"manifestVersion\" | \"objectTypes\" | \"actions\" | \"views\"\n> & {\n\tmanifestVersion: 1;\n\tobjectTypes: ModuleManifestObjectTypeV1[];\n\tactions: ModuleManifestActionV1[];\n};\nexport type ModuleManifestBundleV1 = Omit<ModuleManifestBundle, \"manifestVersion\" | \"modules\"> & {\n\tmanifestVersion: 1;\n\tmodules: ModuleManifestV1[];\n};\n\nexport function normalizeModuleManifest(\n\tmanifest: ModuleManifest | ModuleManifestV1,\n): ModuleManifest {\n\tconst version: number = manifest.manifestVersion;\n\tif (version !== 1 && version !== MODULE_MANIFEST_VERSION) {\n\t\tthrow new Error(`Unsupported module manifest version: ${String(version)}`);\n\t}\n\tconst views = \"views\" in manifest && Array.isArray(manifest.views) ? manifest.views : [];\n\t// Preserve the normalizer's legacy tolerance for absent/non-array fields.\n\tif (Array.isArray(manifest.actions))\n\t\tfor (const [index, action] of manifest.actions.entries()) {\n\t\t\tassertSurfaceDeclaration(action, `Module \"${manifest.namespace}\" action[${index}] \"${action?.actionId ?? \"unknown\"}\"`);\n\t\t\tassertAdapterStepDeadlines(action);\n\t\t\tif (action.finalization !== undefined) {\n\t\t\t\tconst descriptor = action.finalization;\n\t\t\t\tif (!descriptor || typeof descriptor !== \"object\" || Array.isArray(descriptor) ||\n\t\t\t\t\tObject.keys(descriptor).some(key => key !== \"protocol\") || descriptor.protocol !== \"atomic-after-adapters-v1\")\n\t\t\t\t\tthrow new Error(\"Invalid action finalization protocol descriptor.\");\n\t\t\t\tif (action.eventPhase !== \"after_adapters\" || (action.kind !== undefined && action.kind !== \"atomic\") ||\n\t\t\t\t\t(action.execution?.completion !== undefined && action.execution.completion !== \"immediate\"))\n\t\t\t\t\tthrow new Error(\"Incompatible action finalization declaration.\");\n\t\t\t}\n\t\t}\n\tfor (const [index, view] of views.entries())\n\t\tassertSurfaceDeclaration(view, `Module \"${manifest.namespace}\" view[${index}] \"${view?.name ?? \"unknown\"}\"`);\n\treturn {\n\t\t...manifest,\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tviews,\n\t};\n}\n\nexport function normalizeModuleManifestBundle(\n\tbundle: ModuleManifestBundle | ModuleManifestBundleV1,\n): ModuleManifestBundle {\n\tconst version: number = bundle.manifestVersion;\n\tif (version !== 1 && version !== MODULE_MANIFEST_VERSION) {\n\t\tthrow new Error(`Unsupported module manifest bundle version: ${String(version)}`);\n\t}\n\treturn {\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tmodules: bundle.modules.map((manifest) => normalizeModuleManifest(manifest)),\n\t};\n}\n\n/**\n * A {@link SchemaValidator} that can also export its parameter schema as JSON\n * Schema (for example a Zod 4 schema via `z.toJSONSchema`). Keeps the platform\n * zero-dependency while letting schema-bearing actions flow into manifests.\n */\nexport interface JsonSchemaExportableValidator extends SchemaValidator {\n\ttoJSONSchema(): Record<string, unknown>;\n}\n\nexport function isJsonSchemaExportableValidator(\n\tschema: SchemaValidator,\n): schema is JsonSchemaExportableValidator {\n\treturn (\n\t\ttypeof (schema as Partial<JsonSchemaExportableValidator>).toJSONSchema === \"function\"\n\t);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction exportDependency(dependency: ModuleDependencyInput): ModuleDependency {\n\tconst namespace = getModuleDependencyNamespace(dependency);\n\tif (typeof dependency === \"string\") {\n\t\treturn { namespace };\n\t}\n\tconst normalized: ModuleDependency = { namespace };\n\tif (dependency.version !== undefined) normalized.version = dependency.version;\n\tif (dependency.optional !== undefined) normalized.optional = dependency.optional;\n\treturn normalized;\n}\n\nfunction exportObjectType(\n\tobjectType: NonNullable<FabricModule[\"objectTypes\"]>[number],\n): ModuleManifestObjectType {\n\tif (typeof objectType === \"string\") {\n\t\treturn { type: objectType };\n\t}\n\tconst normalized: ModuleManifestObjectType = { type: getObjectTypeName(objectType) };\n\tif (objectType.displayName !== undefined) normalized.displayName = objectType.displayName;\n\tif (objectType.idPrefix !== undefined) normalized.idPrefix = objectType.idPrefix;\n\tif (objectType.schema !== undefined) normalized.schema = cloneJson(objectType.schema);\n\tif (objectType.semantics !== undefined) normalized.semantics = cloneJson(objectType.semantics);\n\tif (objectType.relations !== undefined) {\n\t\tnormalized.relations = objectType.relations.map((relation) => ({ ...relation }));\n\t}\n\tif (objectType.invariants !== undefined) {\n\t\tnormalized.invariants = objectType.invariants.map((invariant) => ({ ...invariant }));\n\t}\n\treturn normalized;\n}\n\nfunction cloneJson<T>(value: T): T {\n\tif (Array.isArray(value)) return value.map((item) => cloneJson(item)) as T;\n\tif (value !== null && typeof value === \"object\") {\n\t\treturn Object.fromEntries(\n\t\t\tObject.entries(value as Record<string, unknown>).map(([key, child]) => [key, cloneJson(child)]),\n\t\t) as T;\n\t}\n\treturn value;\n}\n\nfunction exportEventType(\n\teventType: NonNullable<FabricModule[\"eventTypes\"]>[number],\n): ModuleManifestEventType {\n\tif (typeof eventType === \"string\") {\n\t\t// String registrations carry no explicit schema version; the events\n\t\t// registry treats the bare name as the initial version of the type.\n\t\treturn { eventType, schemaVersion: 1 };\n\t}\n\tconst normalized: ModuleManifestEventType = {\n\t\teventType: getEventTypeName(eventType),\n\t\tschemaVersion: eventType.schemaVersion,\n\t};\n\tif (eventType.description !== undefined) normalized.description = eventType.description;\n\tif (eventType.schema !== undefined) normalized.schema = cloneJson(eventType.schema);\n\treturn normalized;\n}\n\nfunction exportAction(action: ActionDefinition): ModuleManifestAction {\n\tassertSurfaceDeclaration(action, `Action \"${action?.actionId ?? \"unknown\"}\"`);\n\tassertAdapterStepDeadlines(action);\n\tconst manifest: ModuleManifestAction = {\n\t\tactionId: action.actionId,\n\t\tversion: action.version,\n\t\tkind: action.kind ?? \"atomic\",\n\t\tidempotent: action.idempotent,\n\t\tmutatesDomain: action.mutatesDomain,\n\t\temitsEvents: [...action.emitsEvents],\n\t};\n\n\tif (action.surface !== undefined) manifest.surface = action.surface;\n\tif (action.surfaceReason !== undefined) manifest.surfaceReason = action.surfaceReason;\n\tif (action.policies !== undefined) manifest.policies = [...action.policies];\n\tif (action.requiredRoles !== undefined) manifest.requiredRoles = [...action.requiredRoles];\n\tif (action.requiredPermissions !== undefined) {\n\t\tmanifest.requiredPermissions = [...action.requiredPermissions];\n\t}\n\tif (action.eventPhase !== undefined) manifest.eventPhase = action.eventPhase;\n\tif (action.finalize !== undefined) manifest.finalization = { protocol: \"atomic-after-adapters-v1\" };\n\tif (action.execution !== undefined) manifest.execution = cloneJson(action.execution);\n\n\tif (isJsonSchemaExportableValidator(action.schema)) {\n\t\ttry {\n\t\t\tmanifest.parameterSchema = action.schema.toJSONSchema();\n\t\t\tmanifest.parameterSchemaFormat = \"json-schema\";\n\t\t} catch {\n\t\t\t// Runtime-valid schemas that cannot be represented portably remain executable;\n\t\t\t// build-time consumers see the schema as unavailable rather than crashing export.\n\t\t}\n\t}\n\tif (action.resultSchema && isJsonSchemaExportableValidator(action.resultSchema)) {\n\t\ttry {\n\t\t\tmanifest.resultSchema = action.resultSchema.toJSONSchema();\n\t\t\tmanifest.resultSchemaFormat = \"json-schema\";\n\t\t} catch {\n\t\t\t// See parameter-schema behavior above.\n\t\t}\n\t}\n\n\tif (action.stateMachine !== undefined) {\n\t\tconst binding: ModuleManifestActionStateMachine = {\n\t\t\tentityType: action.stateMachine.entityType,\n\t\t};\n\t\tif (typeof action.stateMachine.targetState === \"string\") {\n\t\t\tbinding.targetState = action.stateMachine.targetState;\n\t\t}\n\t\tmanifest.stateMachine = binding;\n\t}\n\n\tif (action.adapterSteps !== undefined) {\n\t\tmanifest.adapterSteps = action.adapterSteps.map((step) => {\n\t\t\tconst exported: ModuleManifestAdapterStep = {\n\t\t\t\tadapterType: step.adapterType,\n\t\t\t\toperation: step.operation,\n\t\t\t};\n\t\t\tif (step.retryPolicy !== undefined) exported.retryPolicy = { ...step.retryPolicy };\n\t\t\tif (step.deadlineMs !== undefined) exported.deadlineMs = step.deadlineMs;\n\t\t\treturn exported;\n\t\t});\n\t}\n\n\treturn manifest;\n}\n\nfunction exportPolicy(policy: unknown): ModuleManifestPolicy | undefined {\n\tif (!isRecord(policy) || typeof policy.policyId !== \"string\") {\n\t\treturn undefined;\n\t}\n\n\t// Code evaluator: identified by its `evaluate` function (never serialized).\n\tif (typeof policy.evaluate === \"function\") {\n\t\tconst exported: ModuleManifestCodePolicy = {\n\t\t\ttype: \"code\",\n\t\t\tpolicyId: policy.policyId,\n\t\t\tversion: typeof policy.version === \"number\" ? policy.version : 1,\n\t\t};\n\t\tif (typeof policy.previewSafe === \"boolean\") exported.previewSafe = policy.previewSafe;\n\t\treturn exported;\n\t}\n\n\t// Declarative runtime policy definition: pure data, serialized as-is.\n\tif (typeof policy.kind === \"string\" && typeof policy.policyVersion === \"number\") {\n\t\tconst exported: ModuleManifestDataPolicy = {\n\t\t\ttype: \"data\",\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tkind: policy.kind as PolicyKind,\n\t\t};\n\t\tif (isRecord(policy.dataDefinition)) {\n\t\t\texported.dataDefinition = policy.dataDefinition as unknown as DataPolicyDefinition;\n\t\t}\n\t\tif (typeof policy.codeEvaluatorPolicyId === \"string\") {\n\t\t\texported.codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId;\n\t\t}\n\t\tif (isRecord(policy.fallback)) {\n\t\t\texported.fallback = policy.fallback as unknown as PolicyFallbackDefinition;\n\t\t}\n\t\treturn exported;\n\t}\n\n\t// Unknown policy shape: omit rather than guess.\n\treturn undefined;\n}\n\nfunction exportStateMachine(machine: unknown): ModuleManifestStateMachine | undefined {\n\tif (\n\t\t!isRecord(machine) ||\n\t\ttypeof machine.entityType !== \"string\" ||\n\t\t!isRecord(machine.states) ||\n\t\t!Array.isArray(machine.transitions)\n\t) {\n\t\treturn undefined;\n\t}\n\n\tconst definition = machine as unknown as StateMachineDefinition;\n\treturn {\n\t\tentityType: definition.entityType,\n\t\tstates: Object.values(definition.states),\n\t\ttransitions: definition.transitions.map((transition) => ({\n\t\t\tfrom: transition.from,\n\t\t\tto: transition.to,\n\t\t\tcausedByAction: transition.causedByAction,\n\t\t\thasGuard: typeof transition.guard === \"function\",\n\t\t})),\n\t};\n}\n\nfunction exportView(view: ViewContract): ModuleManifestView {\n\tassertSurfaceDeclaration(view, `View \"${view?.name ?? \"unknown\"}\"`);\n\tconst output: ModuleManifestView = {\n\t\tname: view.name,\n\t\tversion: view.version,\n\t\tshape: cloneJson(view.shape),\n\t\tconsumes: view.consumes.map((consumption) => ({\n\t\t\teventType: consumption.eventType,\n\t\t\tschemaVersions: [...consumption.schemaVersions],\n\t\t})),\n\t\tscope: view.scope,\n\t\tsnapshotVersion: view.snapshotVersion,\n\t};\n\tif (view.surface !== undefined) output.surface = view.surface;\n\tif (view.surfaceReason !== undefined) output.surfaceReason = view.surfaceReason;\n\tif (view.parameterSchema !== undefined) output.parameterSchema = cloneJson(view.parameterSchema);\n\tif (view.compatibleSnapshotVersions) output.compatibleSnapshotVersions = [...view.compatibleSnapshotVersions];\n\tif (view.usage) output.usage = cloneJson(view.usage);\n\treturn output;\n}\n\n/**\n * Export a stable, JSON-serializable manifest of a module's ontology.\n *\n * This is a pure function of the module object: it does not read or mutate the\n * global module/action/policy/state-machine registries, and the module does\n * not need to be registered first. Declaration order is preserved everywhere\n * (nothing is sorted), so the same module object always produces a\n * byte-identical `JSON.stringify` result.\n *\n * The manifest contains definitions only — never raw parameter values,\n * secrets, or runtime data. Function fields are elided (`handler`,\n * policy `evaluate`, transition `guard` → `hasGuard`, dynamic `targetState`,\n * adapter `getInput`).\n */\nexport function exportModuleManifest(module: FabricModule<unknown>): ModuleManifest {\n\tconst manifest: ModuleManifest = {\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tnamespace: module.namespace,\n\t\tdependencies: (module.dependencies ?? []).map(exportDependency),\n\t\tobjectTypes: (module.objectTypes ?? []).map(exportObjectType),\n\t\tsubjectTypes: [...(module.subjectTypes ?? [])],\n\t\tidPrefixes: (module.idPrefixes ?? []).map((registration) => ({\n\t\t\tprefix: registration.prefix,\n\t\t\tname: registration.name,\n\t\t})),\n\t\teventTypes: (module.eventTypes ?? []).map(exportEventType),\n\t\tactions: (module.actions ?? []).map(exportAction),\n\t\tpolicies: (module.policies ?? [])\n\t\t\t.map(exportPolicy)\n\t\t\t.filter((policy): policy is ModuleManifestPolicy => policy !== undefined),\n\t\tstateMachines: (module.stateMachines ?? [])\n\t\t\t.map(exportStateMachine)\n\t\t\t.filter((machine): machine is ModuleManifestStateMachine => machine !== undefined),\n\t\tviews: (module.views ?? []).map(exportView),\n\t};\n\n\tif (module.version !== undefined) manifest.version = module.version;\n\tif (module.displayName !== undefined) manifest.displayName = module.displayName;\n\tif (module.description !== undefined) manifest.description = module.description;\n\tif (module.capability !== undefined) manifest.capability = cloneJson(module.capability);\n\n\treturn manifest;\n}\n\n/**\n * Export manifests for a set of modules, preserving the input order.\n * Like {@link exportModuleManifest}, this is pure and registry-free.\n */\nexport function exportModuleManifestBundle(\n\tmodules: FabricModule<unknown>[],\n): ModuleManifestBundle {\n\treturn {\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tmodules: modules.map(exportModuleManifest),\n\t};\n}\n"],"mappings":";;;;;;;;;AAgCA,MAAa,0BAA0B;AAqKvC,SAAgB,wBACf,UACiB;CACjB,MAAM,UAAkB,SAAS;CACjC,IAAI,YAAY,KAAK,YAAA,GACpB,MAAM,IAAI,MAAM,wCAAwC,OAAO,OAAO,GAAG;CAE1E,MAAM,QAAQ,WAAW,YAAY,MAAM,QAAQ,SAAS,KAAK,IAAI,SAAS,QAAQ,CAAC;CAEvF,IAAI,MAAM,QAAQ,SAAS,OAAO,GACjC,KAAK,MAAM,CAAC,OAAO,WAAW,SAAS,QAAQ,QAAQ,GAAG;EACzD,wBAAA,yBAAyB,QAAQ,WAAW,SAAS,UAAU,WAAW,MAAM,KAAK,QAAQ,YAAY,UAAU,EAAE;EACrH,sBAAA,2BAA2B,MAAM;EACjC,IAAI,OAAO,iBAAiB,KAAA,GAAW;GACtC,MAAM,aAAa,OAAO;GAC1B,IAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,KAC5E,OAAO,KAAK,UAAU,CAAC,CAAC,MAAK,QAAO,QAAQ,UAAU,KAAK,WAAW,aAAa,4BACnF,MAAM,IAAI,MAAM,kDAAkD;GACnE,IAAI,OAAO,eAAe,oBAAqB,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,YAC1F,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAC/E,MAAM,IAAI,MAAM,+CAA+C;EACjE;CACD;CACD,KAAK,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,GACzC,wBAAA,yBAAyB,MAAM,WAAW,SAAS,UAAU,SAAS,MAAM,KAAK,MAAM,QAAQ,UAAU,EAAE;CAC5G,OAAO;EACN,GAAG;EACH,iBAAA;EACA;CACD;AACD;AAEA,SAAgB,8BACf,QACuB;CACvB,MAAM,UAAkB,OAAO;CAC/B,IAAI,YAAY,KAAK,YAAA,GACpB,MAAM,IAAI,MAAM,+CAA+C,OAAO,OAAO,GAAG;CAEjF,OAAO;EACN,iBAAA;EACA,SAAS,OAAO,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,CAAC;CAC5E;AACD;AAWA,SAAgB,gCACf,QAC0C;CAC1C,OACC,OAAQ,OAAkD,iBAAiB;AAE7E;AAEA,SAAS,SAAS,OAAkD;CACnE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC3E;AAEA,SAAS,iBAAiB,YAAqD;CAC9E,MAAM,YAAYA,sBAAAA,6BAA6B,UAAU;CACzD,IAAI,OAAO,eAAe,UACzB,OAAO,EAAE,UAAU;CAEpB,MAAM,aAA+B,EAAE,UAAU;CACjD,IAAI,WAAW,YAAY,KAAA,GAAW,WAAW,UAAU,WAAW;CACtE,IAAI,WAAW,aAAa,KAAA,GAAW,WAAW,WAAW,WAAW;CACxE,OAAO;AACR;AAEA,SAAS,iBACR,YAC2B;CAC3B,IAAI,OAAO,eAAe,UACzB,OAAO,EAAE,MAAM,WAAW;CAE3B,MAAM,aAAuC,EAAE,MAAMC,sBAAAA,kBAAkB,UAAU,EAAE;CACnF,IAAI,WAAW,gBAAgB,KAAA,GAAW,WAAW,cAAc,WAAW;CAC9E,IAAI,WAAW,aAAa,KAAA,GAAW,WAAW,WAAW,WAAW;CACxE,IAAI,WAAW,WAAW,KAAA,GAAW,WAAW,SAAS,UAAU,WAAW,MAAM;CACpF,IAAI,WAAW,cAAc,KAAA,GAAW,WAAW,YAAY,UAAU,WAAW,SAAS;CAC7F,IAAI,WAAW,cAAc,KAAA,GAC5B,WAAW,YAAY,WAAW,UAAU,KAAK,cAAc,EAAE,GAAG,SAAS,EAAE;CAEhF,IAAI,WAAW,eAAe,KAAA,GAC7B,WAAW,aAAa,WAAW,WAAW,KAAK,eAAe,EAAE,GAAG,UAAU,EAAE;CAEpF,OAAO;AACR;AAEA,SAAS,UAAa,OAAa;CAClC,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,SAAS,UAAU,IAAI,CAAC;CACpE,IAAI,UAAU,QAAQ,OAAO,UAAU,UACtC,OAAO,OAAO,YACb,OAAO,QAAQ,KAAgC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,UAAU,KAAK,CAAC,CAAC,CAC/F;CAED,OAAO;AACR;AAEA,SAAS,gBACR,WAC0B;CAC1B,IAAI,OAAO,cAAc,UAGxB,OAAO;EAAE;EAAW,eAAe;CAAE;CAEtC,MAAM,aAAsC;EAC3C,WAAWC,sBAAAA,iBAAiB,SAAS;EACrC,eAAe,UAAU;CAC1B;CACA,IAAI,UAAU,gBAAgB,KAAA,GAAW,WAAW,cAAc,UAAU;CAC5E,IAAI,UAAU,WAAW,KAAA,GAAW,WAAW,SAAS,UAAU,UAAU,MAAM;CAClF,OAAO;AACR;AAEA,SAAS,aAAa,QAAgD;CACrE,wBAAA,yBAAyB,QAAQ,WAAW,QAAQ,YAAY,UAAU,EAAE;CAC5E,sBAAA,2BAA2B,MAAM;CACjC,MAAM,WAAiC;EACtC,UAAU,OAAO;EACjB,SAAS,OAAO;EAChB,MAAM,OAAO,QAAQ;EACrB,YAAY,OAAO;EACnB,eAAe,OAAO;EACtB,aAAa,CAAC,GAAG,OAAO,WAAW;CACpC;CAEA,IAAI,OAAO,YAAY,KAAA,GAAW,SAAS,UAAU,OAAO;CAC5D,IAAI,OAAO,kBAAkB,KAAA,GAAW,SAAS,gBAAgB,OAAO;CACxE,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,WAAW,CAAC,GAAG,OAAO,QAAQ;CAC1E,IAAI,OAAO,kBAAkB,KAAA,GAAW,SAAS,gBAAgB,CAAC,GAAG,OAAO,aAAa;CACzF,IAAI,OAAO,wBAAwB,KAAA,GAClC,SAAS,sBAAsB,CAAC,GAAG,OAAO,mBAAmB;CAE9D,IAAI,OAAO,eAAe,KAAA,GAAW,SAAS,aAAa,OAAO;CAClE,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,eAAe,EAAE,UAAU,2BAA2B;CAClG,IAAI,OAAO,cAAc,KAAA,GAAW,SAAS,YAAY,UAAU,OAAO,SAAS;CAEnF,IAAI,gCAAgC,OAAO,MAAM,GAChD,IAAI;EACH,SAAS,kBAAkB,OAAO,OAAO,aAAa;EACtD,SAAS,wBAAwB;CAClC,QAAQ,CAGR;CAED,IAAI,OAAO,gBAAgB,gCAAgC,OAAO,YAAY,GAC7E,IAAI;EACH,SAAS,eAAe,OAAO,aAAa,aAAa;EACzD,SAAS,qBAAqB;CAC/B,QAAQ,CAER;CAGD,IAAI,OAAO,iBAAiB,KAAA,GAAW;EACtC,MAAM,UAA4C,EACjD,YAAY,OAAO,aAAa,WACjC;EACA,IAAI,OAAO,OAAO,aAAa,gBAAgB,UAC9C,QAAQ,cAAc,OAAO,aAAa;EAE3C,SAAS,eAAe;CACzB;CAEA,IAAI,OAAO,iBAAiB,KAAA,GAC3B,SAAS,eAAe,OAAO,aAAa,KAAK,SAAS;EACzD,MAAM,WAAsC;GAC3C,aAAa,KAAK;GAClB,WAAW,KAAK;EACjB;EACA,IAAI,KAAK,gBAAgB,KAAA,GAAW,SAAS,cAAc,EAAE,GAAG,KAAK,YAAY;EACjF,IAAI,KAAK,eAAe,KAAA,GAAW,SAAS,aAAa,KAAK;EAC9D,OAAO;CACR,CAAC;CAGF,OAAO;AACR;AAEA,SAAS,aAAa,QAAmD;CACxE,IAAI,CAAC,SAAS,MAAM,KAAK,OAAO,OAAO,aAAa,UACnD;CAID,IAAI,OAAO,OAAO,aAAa,YAAY;EAC1C,MAAM,WAAqC;GAC1C,MAAM;GACN,UAAU,OAAO;GACjB,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;EAChE;EACA,IAAI,OAAO,OAAO,gBAAgB,WAAW,SAAS,cAAc,OAAO;EAC3E,OAAO;CACR;CAGA,IAAI,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,UAAU;EAChF,MAAM,WAAqC;GAC1C,MAAM;GACN,UAAU,OAAO;GACjB,eAAe,OAAO;GACtB,MAAM,OAAO;EACd;EACA,IAAI,SAAS,OAAO,cAAc,GACjC,SAAS,iBAAiB,OAAO;EAElC,IAAI,OAAO,OAAO,0BAA0B,UAC3C,SAAS,wBAAwB,OAAO;EAEzC,IAAI,SAAS,OAAO,QAAQ,GAC3B,SAAS,WAAW,OAAO;EAE5B,OAAO;CACR;AAID;AAEA,SAAS,mBAAmB,SAA0D;CACrF,IACC,CAAC,SAAS,OAAO,KACjB,OAAO,QAAQ,eAAe,YAC9B,CAAC,SAAS,QAAQ,MAAM,KACxB,CAAC,MAAM,QAAQ,QAAQ,WAAW,GAElC;CAGD,MAAM,aAAa;CACnB,OAAO;EACN,YAAY,WAAW;EACvB,QAAQ,OAAO,OAAO,WAAW,MAAM;EACvC,aAAa,WAAW,YAAY,KAAK,gBAAgB;GACxD,MAAM,WAAW;GACjB,IAAI,WAAW;GACf,gBAAgB,WAAW;GAC3B,UAAU,OAAO,WAAW,UAAU;EACvC,EAAE;CACH;AACD;AAEA,SAAS,WAAW,MAAwC;CAC3D,wBAAA,yBAAyB,MAAM,SAAS,MAAM,QAAQ,UAAU,EAAE;CAClE,MAAM,SAA6B;EAClC,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,UAAU,KAAK,KAAK;EAC3B,UAAU,KAAK,SAAS,KAAK,iBAAiB;GAC7C,WAAW,YAAY;GACvB,gBAAgB,CAAC,GAAG,YAAY,cAAc;EAC/C,EAAE;EACF,OAAO,KAAK;EACZ,iBAAiB,KAAK;CACvB;CACA,IAAI,KAAK,YAAY,KAAA,GAAW,OAAO,UAAU,KAAK;CACtD,IAAI,KAAK,kBAAkB,KAAA,GAAW,OAAO,gBAAgB,KAAK;CAClE,IAAI,KAAK,oBAAoB,KAAA,GAAW,OAAO,kBAAkB,UAAU,KAAK,eAAe;CAC/F,IAAI,KAAK,4BAA4B,OAAO,6BAA6B,CAAC,GAAG,KAAK,0BAA0B;CAC5G,IAAI,KAAK,OAAO,OAAO,QAAQ,UAAU,KAAK,KAAK;CACnD,OAAO;AACR;;;;;;;;;;;;;;;AAgBA,SAAgB,qBAAqB,QAA+C;CACnF,MAAM,WAA2B;EAChC,iBAAA;EACA,WAAW,OAAO;EAClB,eAAe,OAAO,gBAAgB,CAAC,EAAA,CAAG,IAAI,gBAAgB;EAC9D,cAAc,OAAO,eAAe,CAAC,EAAA,CAAG,IAAI,gBAAgB;EAC5D,cAAc,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;EAC7C,aAAa,OAAO,cAAc,CAAC,EAAA,CAAG,KAAK,kBAAkB;GAC5D,QAAQ,aAAa;GACrB,MAAM,aAAa;EACpB,EAAE;EACF,aAAa,OAAO,cAAc,CAAC,EAAA,CAAG,IAAI,eAAe;EACzD,UAAU,OAAO,WAAW,CAAC,EAAA,CAAG,IAAI,YAAY;EAChD,WAAW,OAAO,YAAY,CAAC,EAAA,CAC7B,IAAI,YAAY,CAAC,CACjB,QAAQ,WAA2C,WAAW,KAAA,CAAS;EACzE,gBAAgB,OAAO,iBAAiB,CAAC,EAAA,CACvC,IAAI,kBAAkB,CAAC,CACvB,QAAQ,YAAmD,YAAY,KAAA,CAAS;EAClF,QAAQ,OAAO,SAAS,CAAC,EAAA,CAAG,IAAI,UAAU;CAC3C;CAEA,IAAI,OAAO,YAAY,KAAA,GAAW,SAAS,UAAU,OAAO;CAC5D,IAAI,OAAO,gBAAgB,KAAA,GAAW,SAAS,cAAc,OAAO;CACpE,IAAI,OAAO,gBAAgB,KAAA,GAAW,SAAS,cAAc,OAAO;CACpE,IAAI,OAAO,eAAe,KAAA,GAAW,SAAS,aAAa,UAAU,OAAO,UAAU;CAEtF,OAAO;AACR;;;;;AAMA,SAAgB,2BACf,SACuB;CACvB,OAAO;EACN,iBAAA;EACA,SAAS,QAAQ,IAAI,oBAAoB;CAC1C;AACD"}
+{"version":3,"file":"index.cjs","names":["getModuleDependencyNamespace","getObjectTypeName","getEventTypeName"],"sources":["../../manifest/index.ts"],"sourcesContent":["import { assertAdapterStepDeadlines } from \"../actions\";\nimport { assertSurfaceDeclaration, type SurfaceDeclaration } from \"../discovery\";\nimport type {\n\tActionExecutionContract,\n\tActionDefinition,\n\tAdapterStepRetryPolicy,\n\tSchemaValidator,\n} from \"../actions\";\nimport {\n\tgetEventTypeName,\n\tgetModuleDependencyNamespace,\n\tgetObjectTypeName,\n\ttype FabricModule,\n\ttype CapabilityMetadata,\n\ttype DeclarativeInvariant,\n\ttype ModuleDependency,\n\ttype ModuleDependencyInput,\n\ttype ObjectRelationDefinition,\n} from \"../modules\";\nimport type { JsonValue, PortableJsonSchema } from \"../objects\";\nimport type {\n\tDataPolicyDefinition,\n\tPolicyFallbackDefinition,\n\tPolicyKind,\n} from \"../policies\";\nimport type { StateDefinition, StateMachineDefinition } from \"../state-machines\";\nimport type { ViewContract } from \"../projections\";\n\n/**\n * Version of the module manifest contract. Bump when the serialized shape\n * changes in a way consumers must detect.\n */\nexport const MODULE_MANIFEST_VERSION = 2 as const;\n\nexport interface ModuleManifestObjectType {\n\ttype: string;\n\tdisplayName?: string;\n\tidPrefix?: string;\n\tschema?: PortableJsonSchema;\n\tsemantics?: Record<string, JsonValue>;\n\trelations?: ObjectRelationDefinition[];\n\tinvariants?: DeclarativeInvariant[];\n}\n\nexport interface ModuleManifestIdPrefix {\n\tprefix: string;\n\tname: string;\n}\n\nexport interface ModuleManifestEventType {\n\teventType: string;\n\tschemaVersion: number;\n\tdescription?: string;\n\tschema?: PortableJsonSchema;\n}\n\nexport interface ModuleManifestActionStateMachine {\n\tentityType: string;\n\t/** Present only when the binding declares a static target state. */\n\ttargetState?: string;\n}\n\nexport interface ModuleManifestAdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n}\n\nexport interface ModuleManifestAction extends SurfaceDeclaration {\n\tactionId: string;\n\tversion: number;\n\tkind: \"atomic\" | \"saga\";\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\temitsEvents: string[];\n\tpolicies?: string[];\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tstagesInvocations?: string[];\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\tfinalization?: { protocol: \"atomic-after-adapters-v1\" };\n\texecution?: ActionExecutionContract;\n\t/**\n\t * JSON Schema for the action parameters, present only when the action's\n\t * `schema` validator implements {@link JsonSchemaExportableValidator}.\n\t */\n\tparameterSchema?: unknown;\n\tparameterSchemaFormat?: \"json-schema\";\n\tresultSchema?: unknown;\n\tresultSchemaFormat?: \"json-schema\";\n\tstateMachine?: ModuleManifestActionStateMachine;\n\tadapterSteps?: ModuleManifestAdapterStep[];\n}\n\nexport interface ModuleManifestCodePolicy {\n\ttype: \"code\";\n\tpolicyId: string;\n\tversion: number;\n\tpreviewSafe?: boolean;\n}\n\nexport interface ModuleManifestDataPolicy {\n\ttype: \"data\";\n\tpolicyId: string;\n\tpolicyVersion: number;\n\tkind: PolicyKind;\n\tdataDefinition?: DataPolicyDefinition;\n\tcodeEvaluatorPolicyId?: string;\n\tfallback?: PolicyFallbackDefinition;\n}\n\nexport type ModuleManifestPolicy = ModuleManifestCodePolicy | ModuleManifestDataPolicy;\n\nexport interface ModuleManifestStateMachineTransition {\n\tfrom: string;\n\tto: string;\n\tcausedByAction: string;\n\t/** `true` when the transition declares a guard function. The guard itself is never serialized. */\n\thasGuard: boolean;\n}\n\nexport interface ModuleManifestStateMachine {\n\tentityType: string;\n\t/** States in declaration order (`Object.values` order of the definition record). */\n\tstates: StateDefinition[];\n\ttransitions: ModuleManifestStateMachineTransition[];\n}\n\nexport interface ModuleManifestView extends SurfaceDeclaration {\n\tname: string;\n\tversion: string;\n\tshape: PortableJsonSchema;\n\tparameterSchema?: PortableJsonSchema;\n\tconsumes: Array<{ eventType: string; schemaVersions: number[] }>;\n\tscope: \"tenant-space\";\n\tsnapshotVersion: number;\n\tcompatibleSnapshotVersions?: number[];\n\tusage?: ViewContract[\"usage\"];\n}\n\n/**\n * Stable, JSON-serializable description of a {@link FabricModule}'s ontology:\n * object types, subject types, id prefixes, event types, actions, policies,\n * and state machines. Intended for downstream tooling (semantics exporters,\n * docs generators, tool generators) that cannot consume live module code.\n *\n * The manifest contains definitions only — never raw parameter values,\n * secrets, or runtime data. Function fields (`handler`, `evaluate`, `guard`,\n * dynamic `targetState`, adapter `getInput`) are never serialized.\n */\nexport interface ModuleManifest {\n\tmanifestVersion: typeof MODULE_MANIFEST_VERSION;\n\tnamespace: string;\n\tversion?: string;\n\tdisplayName?: string;\n\tdescription?: string;\n\tcapability?: CapabilityMetadata;\n\tdependencies: ModuleDependency[];\n\tobjectTypes: ModuleManifestObjectType[];\n\tsubjectTypes: string[];\n\tidPrefixes: ModuleManifestIdPrefix[];\n\teventTypes: ModuleManifestEventType[];\n\tactions: ModuleManifestAction[];\n\tpolicies: ModuleManifestPolicy[];\n\tstateMachines: ModuleManifestStateMachine[];\n\tviews: ModuleManifestView[];\n}\n\nexport interface ModuleManifestBundle {\n\tmanifestVersion: typeof MODULE_MANIFEST_VERSION;\n\t/** Manifests in the input module order. */\n\tmodules: ModuleManifest[];\n}\n\n/** Manifest v1 remains accepted by v2 readers; missing v2 fields normalize to absence. */\nexport type ModuleManifestObjectTypeV1 = Omit<\n\tModuleManifestObjectType,\n\t\"schema\" | \"semantics\" | \"relations\" | \"invariants\"\n>;\nexport type ModuleManifestActionV1 = Omit<\n\tModuleManifestAction,\n\t\"resultSchema\" | \"resultSchemaFormat\"\n>;\nexport type ModuleManifestV1 = Omit<\n\tModuleManifest,\n\t\"manifestVersion\" | \"objectTypes\" | \"actions\" | \"views\"\n> & {\n\tmanifestVersion: 1;\n\tobjectTypes: ModuleManifestObjectTypeV1[];\n\tactions: ModuleManifestActionV1[];\n};\nexport type ModuleManifestBundleV1 = Omit<ModuleManifestBundle, \"manifestVersion\" | \"modules\"> & {\n\tmanifestVersion: 1;\n\tmodules: ModuleManifestV1[];\n};\n\nexport function normalizeModuleManifest(\n\tmanifest: ModuleManifest | ModuleManifestV1,\n): ModuleManifest {\n\tconst version: number = manifest.manifestVersion;\n\tif (version !== 1 && version !== MODULE_MANIFEST_VERSION) {\n\t\tthrow new Error(`Unsupported module manifest version: ${String(version)}`);\n\t}\n\tconst views = \"views\" in manifest && Array.isArray(manifest.views) ? manifest.views : [];\n\t// Preserve the normalizer's legacy tolerance for absent/non-array fields.\n\tif (Array.isArray(manifest.actions))\n\t\tfor (const [index, action] of manifest.actions.entries()) {\n\t\t\tassertSurfaceDeclaration(action, `Module \"${manifest.namespace}\" action[${index}] \"${action?.actionId ?? \"unknown\"}\"`);\n\t\t\tassertAdapterStepDeadlines(action);\n\t\t\tif (action.finalization !== undefined) {\n\t\t\t\tconst descriptor = action.finalization;\n\t\t\t\tif (!descriptor || typeof descriptor !== \"object\" || Array.isArray(descriptor) ||\n\t\t\t\t\tObject.keys(descriptor).some(key => key !== \"protocol\") || descriptor.protocol !== \"atomic-after-adapters-v1\")\n\t\t\t\t\tthrow new Error(\"Invalid action finalization protocol descriptor.\");\n\t\t\t\tif (action.eventPhase !== \"after_adapters\" || (action.kind !== undefined && action.kind !== \"atomic\") ||\n\t\t\t\t\t(action.execution?.completion !== undefined && action.execution.completion !== \"immediate\"))\n\t\t\t\t\tthrow new Error(\"Incompatible action finalization declaration.\");\n\t\t\t}\n\t\t}\n\tfor (const [index, view] of views.entries())\n\t\tassertSurfaceDeclaration(view, `Module \"${manifest.namespace}\" view[${index}] \"${view?.name ?? \"unknown\"}\"`);\n\treturn {\n\t\t...manifest,\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tviews,\n\t};\n}\n\nexport function normalizeModuleManifestBundle(\n\tbundle: ModuleManifestBundle | ModuleManifestBundleV1,\n): ModuleManifestBundle {\n\tconst version: number = bundle.manifestVersion;\n\tif (version !== 1 && version !== MODULE_MANIFEST_VERSION) {\n\t\tthrow new Error(`Unsupported module manifest bundle version: ${String(version)}`);\n\t}\n\treturn {\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tmodules: bundle.modules.map((manifest) => normalizeModuleManifest(manifest)),\n\t};\n}\n\n/**\n * A {@link SchemaValidator} that can also export its parameter schema as JSON\n * Schema (for example a Zod 4 schema via `z.toJSONSchema`). Keeps the platform\n * zero-dependency while letting schema-bearing actions flow into manifests.\n */\nexport interface JsonSchemaExportableValidator extends SchemaValidator {\n\ttoJSONSchema(): Record<string, unknown>;\n}\n\nexport function isJsonSchemaExportableValidator(\n\tschema: SchemaValidator,\n): schema is JsonSchemaExportableValidator {\n\treturn (\n\t\ttypeof (schema as Partial<JsonSchemaExportableValidator>).toJSONSchema === \"function\"\n\t);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn value !== null && typeof value === \"object\" && !Array.isArray(value);\n}\n\nfunction exportDependency(dependency: ModuleDependencyInput): ModuleDependency {\n\tconst namespace = getModuleDependencyNamespace(dependency);\n\tif (typeof dependency === \"string\") {\n\t\treturn { namespace };\n\t}\n\tconst normalized: ModuleDependency = { namespace };\n\tif (dependency.version !== undefined) normalized.version = dependency.version;\n\tif (dependency.optional !== undefined) normalized.optional = dependency.optional;\n\treturn normalized;\n}\n\nfunction exportObjectType(\n\tobjectType: NonNullable<FabricModule[\"objectTypes\"]>[number],\n): ModuleManifestObjectType {\n\tif (typeof objectType === \"string\") {\n\t\treturn { type: objectType };\n\t}\n\tconst normalized: ModuleManifestObjectType = { type: getObjectTypeName(objectType) };\n\tif (objectType.displayName !== undefined) normalized.displayName = objectType.displayName;\n\tif (objectType.idPrefix !== undefined) normalized.idPrefix = objectType.idPrefix;\n\tif (objectType.schema !== undefined) normalized.schema = cloneJson(objectType.schema);\n\tif (objectType.semantics !== undefined) normalized.semantics = cloneJson(objectType.semantics);\n\tif (objectType.relations !== undefined) {\n\t\tnormalized.relations = objectType.relations.map((relation) => ({ ...relation }));\n\t}\n\tif (objectType.invariants !== undefined) {\n\t\tnormalized.invariants = objectType.invariants.map((invariant) => ({ ...invariant }));\n\t}\n\treturn normalized;\n}\n\nfunction cloneJson<T>(value: T): T {\n\tif (Array.isArray(value)) return value.map((item) => cloneJson(item)) as T;\n\tif (value !== null && typeof value === \"object\") {\n\t\treturn Object.fromEntries(\n\t\t\tObject.entries(value as Record<string, unknown>).map(([key, child]) => [key, cloneJson(child)]),\n\t\t) as T;\n\t}\n\treturn value;\n}\n\nfunction exportEventType(\n\teventType: NonNullable<FabricModule[\"eventTypes\"]>[number],\n): ModuleManifestEventType {\n\tif (typeof eventType === \"string\") {\n\t\t// String registrations carry no explicit schema version; the events\n\t\t// registry treats the bare name as the initial version of the type.\n\t\treturn { eventType, schemaVersion: 1 };\n\t}\n\tconst normalized: ModuleManifestEventType = {\n\t\teventType: getEventTypeName(eventType),\n\t\tschemaVersion: eventType.schemaVersion,\n\t};\n\tif (eventType.description !== undefined) normalized.description = eventType.description;\n\tif (eventType.schema !== undefined) normalized.schema = cloneJson(eventType.schema);\n\treturn normalized;\n}\n\nfunction exportAction(action: ActionDefinition): ModuleManifestAction {\n\tassertSurfaceDeclaration(action, `Action \"${action?.actionId ?? \"unknown\"}\"`);\n\tassertAdapterStepDeadlines(action);\n\tconst manifest: ModuleManifestAction = {\n\t\tactionId: action.actionId,\n\t\tversion: action.version,\n\t\tkind: action.kind ?? \"atomic\",\n\t\tidempotent: action.idempotent,\n\t\tmutatesDomain: action.mutatesDomain,\n\t\temitsEvents: [...action.emitsEvents],\n\t};\n\n\tif (action.surface !== undefined) manifest.surface = action.surface;\n\tif (action.surfaceReason !== undefined) manifest.surfaceReason = action.surfaceReason;\n\tif (action.policies !== undefined) manifest.policies = [...action.policies];\n\tif (action.requiredRoles !== undefined) manifest.requiredRoles = [...action.requiredRoles];\n\tif (action.requiredPermissions !== undefined) {\n\t\tmanifest.requiredPermissions = [...action.requiredPermissions];\n\t}\n\tif (action.stagesInvocations !== undefined) manifest.stagesInvocations = [...action.stagesInvocations];\n\tif (action.eventPhase !== undefined) manifest.eventPhase = action.eventPhase;\n\tif (action.finalize !== undefined) manifest.finalization = { protocol: \"atomic-after-adapters-v1\" };\n\tif (action.execution !== undefined) manifest.execution = cloneJson(action.execution);\n\n\tif (isJsonSchemaExportableValidator(action.schema)) {\n\t\ttry {\n\t\t\tmanifest.parameterSchema = action.schema.toJSONSchema();\n\t\t\tmanifest.parameterSchemaFormat = \"json-schema\";\n\t\t} catch {\n\t\t\t// Runtime-valid schemas that cannot be represented portably remain executable;\n\t\t\t// build-time consumers see the schema as unavailable rather than crashing export.\n\t\t}\n\t}\n\tif (action.resultSchema && isJsonSchemaExportableValidator(action.resultSchema)) {\n\t\ttry {\n\t\t\tmanifest.resultSchema = action.resultSchema.toJSONSchema();\n\t\t\tmanifest.resultSchemaFormat = \"json-schema\";\n\t\t} catch {\n\t\t\t// See parameter-schema behavior above.\n\t\t}\n\t}\n\n\tif (action.stateMachine !== undefined) {\n\t\tconst binding: ModuleManifestActionStateMachine = {\n\t\t\tentityType: action.stateMachine.entityType,\n\t\t};\n\t\tif (typeof action.stateMachine.targetState === \"string\") {\n\t\t\tbinding.targetState = action.stateMachine.targetState;\n\t\t}\n\t\tmanifest.stateMachine = binding;\n\t}\n\n\tif (action.adapterSteps !== undefined) {\n\t\tmanifest.adapterSteps = action.adapterSteps.map((step) => {\n\t\t\tconst exported: ModuleManifestAdapterStep = {\n\t\t\t\tadapterType: step.adapterType,\n\t\t\t\toperation: step.operation,\n\t\t\t};\n\t\t\tif (step.retryPolicy !== undefined) exported.retryPolicy = { ...step.retryPolicy };\n\t\t\tif (step.deadlineMs !== undefined) exported.deadlineMs = step.deadlineMs;\n\t\t\treturn exported;\n\t\t});\n\t}\n\n\treturn manifest;\n}\n\nfunction exportPolicy(policy: unknown): ModuleManifestPolicy | undefined {\n\tif (!isRecord(policy) || typeof policy.policyId !== \"string\") {\n\t\treturn undefined;\n\t}\n\n\t// Code evaluator: identified by its `evaluate` function (never serialized).\n\tif (typeof policy.evaluate === \"function\") {\n\t\tconst exported: ModuleManifestCodePolicy = {\n\t\t\ttype: \"code\",\n\t\t\tpolicyId: policy.policyId,\n\t\t\tversion: typeof policy.version === \"number\" ? policy.version : 1,\n\t\t};\n\t\tif (typeof policy.previewSafe === \"boolean\") exported.previewSafe = policy.previewSafe;\n\t\treturn exported;\n\t}\n\n\t// Declarative runtime policy definition: pure data, serialized as-is.\n\tif (typeof policy.kind === \"string\" && typeof policy.policyVersion === \"number\") {\n\t\tconst exported: ModuleManifestDataPolicy = {\n\t\t\ttype: \"data\",\n\t\t\tpolicyId: policy.policyId,\n\t\t\tpolicyVersion: policy.policyVersion,\n\t\t\tkind: policy.kind as PolicyKind,\n\t\t};\n\t\tif (isRecord(policy.dataDefinition)) {\n\t\t\texported.dataDefinition = policy.dataDefinition as unknown as DataPolicyDefinition;\n\t\t}\n\t\tif (typeof policy.codeEvaluatorPolicyId === \"string\") {\n\t\t\texported.codeEvaluatorPolicyId = policy.codeEvaluatorPolicyId;\n\t\t}\n\t\tif (isRecord(policy.fallback)) {\n\t\t\texported.fallback = policy.fallback as unknown as PolicyFallbackDefinition;\n\t\t}\n\t\treturn exported;\n\t}\n\n\t// Unknown policy shape: omit rather than guess.\n\treturn undefined;\n}\n\nfunction exportStateMachine(machine: unknown): ModuleManifestStateMachine | undefined {\n\tif (\n\t\t!isRecord(machine) ||\n\t\ttypeof machine.entityType !== \"string\" ||\n\t\t!isRecord(machine.states) ||\n\t\t!Array.isArray(machine.transitions)\n\t) {\n\t\treturn undefined;\n\t}\n\n\tconst definition = machine as unknown as StateMachineDefinition;\n\treturn {\n\t\tentityType: definition.entityType,\n\t\tstates: Object.values(definition.states),\n\t\ttransitions: definition.transitions.map((transition) => ({\n\t\t\tfrom: transition.from,\n\t\t\tto: transition.to,\n\t\t\tcausedByAction: transition.causedByAction,\n\t\t\thasGuard: typeof transition.guard === \"function\",\n\t\t})),\n\t};\n}\n\nfunction exportView(view: ViewContract): ModuleManifestView {\n\tassertSurfaceDeclaration(view, `View \"${view?.name ?? \"unknown\"}\"`);\n\tconst output: ModuleManifestView = {\n\t\tname: view.name,\n\t\tversion: view.version,\n\t\tshape: cloneJson(view.shape),\n\t\tconsumes: view.consumes.map((consumption) => ({\n\t\t\teventType: consumption.eventType,\n\t\t\tschemaVersions: [...consumption.schemaVersions],\n\t\t})),\n\t\tscope: view.scope,\n\t\tsnapshotVersion: view.snapshotVersion,\n\t};\n\tif (view.surface !== undefined) output.surface = view.surface;\n\tif (view.surfaceReason !== undefined) output.surfaceReason = view.surfaceReason;\n\tif (view.parameterSchema !== undefined) output.parameterSchema = cloneJson(view.parameterSchema);\n\tif (view.compatibleSnapshotVersions) output.compatibleSnapshotVersions = [...view.compatibleSnapshotVersions];\n\tif (view.usage) output.usage = cloneJson(view.usage);\n\treturn output;\n}\n\n/**\n * Export a stable, JSON-serializable manifest of a module's ontology.\n *\n * This is a pure function of the module object: it does not read or mutate the\n * global module/action/policy/state-machine registries, and the module does\n * not need to be registered first. Declaration order is preserved everywhere\n * (nothing is sorted), so the same module object always produces a\n * byte-identical `JSON.stringify` result.\n *\n * The manifest contains definitions only — never raw parameter values,\n * secrets, or runtime data. Function fields are elided (`handler`,\n * policy `evaluate`, transition `guard` → `hasGuard`, dynamic `targetState`,\n * adapter `getInput`).\n */\nexport function exportModuleManifest(module: FabricModule<unknown>): ModuleManifest {\n\tconst manifest: ModuleManifest = {\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tnamespace: module.namespace,\n\t\tdependencies: (module.dependencies ?? []).map(exportDependency),\n\t\tobjectTypes: (module.objectTypes ?? []).map(exportObjectType),\n\t\tsubjectTypes: [...(module.subjectTypes ?? [])],\n\t\tidPrefixes: (module.idPrefixes ?? []).map((registration) => ({\n\t\t\tprefix: registration.prefix,\n\t\t\tname: registration.name,\n\t\t})),\n\t\teventTypes: (module.eventTypes ?? []).map(exportEventType),\n\t\tactions: (module.actions ?? []).map(exportAction),\n\t\tpolicies: (module.policies ?? [])\n\t\t\t.map(exportPolicy)\n\t\t\t.filter((policy): policy is ModuleManifestPolicy => policy !== undefined),\n\t\tstateMachines: (module.stateMachines ?? [])\n\t\t\t.map(exportStateMachine)\n\t\t\t.filter((machine): machine is ModuleManifestStateMachine => machine !== undefined),\n\t\tviews: (module.views ?? []).map(exportView),\n\t};\n\n\tif (module.version !== undefined) manifest.version = module.version;\n\tif (module.displayName !== undefined) manifest.displayName = module.displayName;\n\tif (module.description !== undefined) manifest.description = module.description;\n\tif (module.capability !== undefined) manifest.capability = cloneJson(module.capability);\n\n\treturn manifest;\n}\n\n/**\n * Export manifests for a set of modules, preserving the input order.\n * Like {@link exportModuleManifest}, this is pure and registry-free.\n */\nexport function exportModuleManifestBundle(\n\tmodules: FabricModule<unknown>[],\n): ModuleManifestBundle {\n\treturn {\n\t\tmanifestVersion: MODULE_MANIFEST_VERSION,\n\t\tmodules: modules.map(exportModuleManifest),\n\t};\n}\n"],"mappings":";;;;;;;;;AAgCA,MAAa,0BAA0B;AAsKvC,SAAgB,wBACf,UACiB;CACjB,MAAM,UAAkB,SAAS;CACjC,IAAI,YAAY,KAAK,YAAA,GACpB,MAAM,IAAI,MAAM,wCAAwC,OAAO,OAAO,GAAG;CAE1E,MAAM,QAAQ,WAAW,YAAY,MAAM,QAAQ,SAAS,KAAK,IAAI,SAAS,QAAQ,CAAC;CAEvF,IAAI,MAAM,QAAQ,SAAS,OAAO,GACjC,KAAK,MAAM,CAAC,OAAO,WAAW,SAAS,QAAQ,QAAQ,GAAG;EACzD,wBAAA,yBAAyB,QAAQ,WAAW,SAAS,UAAU,WAAW,MAAM,KAAK,QAAQ,YAAY,UAAU,EAAE;EACrH,sBAAA,2BAA2B,MAAM;EACjC,IAAI,OAAO,iBAAiB,KAAA,GAAW;GACtC,MAAM,aAAa,OAAO;GAC1B,IAAI,CAAC,cAAc,OAAO,eAAe,YAAY,MAAM,QAAQ,UAAU,KAC5E,OAAO,KAAK,UAAU,CAAC,CAAC,MAAK,QAAO,QAAQ,UAAU,KAAK,WAAW,aAAa,4BACnF,MAAM,IAAI,MAAM,kDAAkD;GACnE,IAAI,OAAO,eAAe,oBAAqB,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,YAC1F,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAC/E,MAAM,IAAI,MAAM,+CAA+C;EACjE;CACD;CACD,KAAK,MAAM,CAAC,OAAO,SAAS,MAAM,QAAQ,GACzC,wBAAA,yBAAyB,MAAM,WAAW,SAAS,UAAU,SAAS,MAAM,KAAK,MAAM,QAAQ,UAAU,EAAE;CAC5G,OAAO;EACN,GAAG;EACH,iBAAA;EACA;CACD;AACD;AAEA,SAAgB,8BACf,QACuB;CACvB,MAAM,UAAkB,OAAO;CAC/B,IAAI,YAAY,KAAK,YAAA,GACpB,MAAM,IAAI,MAAM,+CAA+C,OAAO,OAAO,GAAG;CAEjF,OAAO;EACN,iBAAA;EACA,SAAS,OAAO,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,CAAC;CAC5E;AACD;AAWA,SAAgB,gCACf,QAC0C;CAC1C,OACC,OAAQ,OAAkD,iBAAiB;AAE7E;AAEA,SAAS,SAAS,OAAkD;CACnE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC3E;AAEA,SAAS,iBAAiB,YAAqD;CAC9E,MAAM,YAAYA,sBAAAA,6BAA6B,UAAU;CACzD,IAAI,OAAO,eAAe,UACzB,OAAO,EAAE,UAAU;CAEpB,MAAM,aAA+B,EAAE,UAAU;CACjD,IAAI,WAAW,YAAY,KAAA,GAAW,WAAW,UAAU,WAAW;CACtE,IAAI,WAAW,aAAa,KAAA,GAAW,WAAW,WAAW,WAAW;CACxE,OAAO;AACR;AAEA,SAAS,iBACR,YAC2B;CAC3B,IAAI,OAAO,eAAe,UACzB,OAAO,EAAE,MAAM,WAAW;CAE3B,MAAM,aAAuC,EAAE,MAAMC,sBAAAA,kBAAkB,UAAU,EAAE;CACnF,IAAI,WAAW,gBAAgB,KAAA,GAAW,WAAW,cAAc,WAAW;CAC9E,IAAI,WAAW,aAAa,KAAA,GAAW,WAAW,WAAW,WAAW;CACxE,IAAI,WAAW,WAAW,KAAA,GAAW,WAAW,SAAS,UAAU,WAAW,MAAM;CACpF,IAAI,WAAW,cAAc,KAAA,GAAW,WAAW,YAAY,UAAU,WAAW,SAAS;CAC7F,IAAI,WAAW,cAAc,KAAA,GAC5B,WAAW,YAAY,WAAW,UAAU,KAAK,cAAc,EAAE,GAAG,SAAS,EAAE;CAEhF,IAAI,WAAW,eAAe,KAAA,GAC7B,WAAW,aAAa,WAAW,WAAW,KAAK,eAAe,EAAE,GAAG,UAAU,EAAE;CAEpF,OAAO;AACR;AAEA,SAAS,UAAa,OAAa;CAClC,IAAI,MAAM,QAAQ,KAAK,GAAG,OAAO,MAAM,KAAK,SAAS,UAAU,IAAI,CAAC;CACpE,IAAI,UAAU,QAAQ,OAAO,UAAU,UACtC,OAAO,OAAO,YACb,OAAO,QAAQ,KAAgC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,UAAU,KAAK,CAAC,CAAC,CAC/F;CAED,OAAO;AACR;AAEA,SAAS,gBACR,WAC0B;CAC1B,IAAI,OAAO,cAAc,UAGxB,OAAO;EAAE;EAAW,eAAe;CAAE;CAEtC,MAAM,aAAsC;EAC3C,WAAWC,sBAAAA,iBAAiB,SAAS;EACrC,eAAe,UAAU;CAC1B;CACA,IAAI,UAAU,gBAAgB,KAAA,GAAW,WAAW,cAAc,UAAU;CAC5E,IAAI,UAAU,WAAW,KAAA,GAAW,WAAW,SAAS,UAAU,UAAU,MAAM;CAClF,OAAO;AACR;AAEA,SAAS,aAAa,QAAgD;CACrE,wBAAA,yBAAyB,QAAQ,WAAW,QAAQ,YAAY,UAAU,EAAE;CAC5E,sBAAA,2BAA2B,MAAM;CACjC,MAAM,WAAiC;EACtC,UAAU,OAAO;EACjB,SAAS,OAAO;EAChB,MAAM,OAAO,QAAQ;EACrB,YAAY,OAAO;EACnB,eAAe,OAAO;EACtB,aAAa,CAAC,GAAG,OAAO,WAAW;CACpC;CAEA,IAAI,OAAO,YAAY,KAAA,GAAW,SAAS,UAAU,OAAO;CAC5D,IAAI,OAAO,kBAAkB,KAAA,GAAW,SAAS,gBAAgB,OAAO;CACxE,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,WAAW,CAAC,GAAG,OAAO,QAAQ;CAC1E,IAAI,OAAO,kBAAkB,KAAA,GAAW,SAAS,gBAAgB,CAAC,GAAG,OAAO,aAAa;CACzF,IAAI,OAAO,wBAAwB,KAAA,GAClC,SAAS,sBAAsB,CAAC,GAAG,OAAO,mBAAmB;CAE9D,IAAI,OAAO,sBAAsB,KAAA,GAAW,SAAS,oBAAoB,CAAC,GAAG,OAAO,iBAAiB;CACrG,IAAI,OAAO,eAAe,KAAA,GAAW,SAAS,aAAa,OAAO;CAClE,IAAI,OAAO,aAAa,KAAA,GAAW,SAAS,eAAe,EAAE,UAAU,2BAA2B;CAClG,IAAI,OAAO,cAAc,KAAA,GAAW,SAAS,YAAY,UAAU,OAAO,SAAS;CAEnF,IAAI,gCAAgC,OAAO,MAAM,GAChD,IAAI;EACH,SAAS,kBAAkB,OAAO,OAAO,aAAa;EACtD,SAAS,wBAAwB;CAClC,QAAQ,CAGR;CAED,IAAI,OAAO,gBAAgB,gCAAgC,OAAO,YAAY,GAC7E,IAAI;EACH,SAAS,eAAe,OAAO,aAAa,aAAa;EACzD,SAAS,qBAAqB;CAC/B,QAAQ,CAER;CAGD,IAAI,OAAO,iBAAiB,KAAA,GAAW;EACtC,MAAM,UAA4C,EACjD,YAAY,OAAO,aAAa,WACjC;EACA,IAAI,OAAO,OAAO,aAAa,gBAAgB,UAC9C,QAAQ,cAAc,OAAO,aAAa;EAE3C,SAAS,eAAe;CACzB;CAEA,IAAI,OAAO,iBAAiB,KAAA,GAC3B,SAAS,eAAe,OAAO,aAAa,KAAK,SAAS;EACzD,MAAM,WAAsC;GAC3C,aAAa,KAAK;GAClB,WAAW,KAAK;EACjB;EACA,IAAI,KAAK,gBAAgB,KAAA,GAAW,SAAS,cAAc,EAAE,GAAG,KAAK,YAAY;EACjF,IAAI,KAAK,eAAe,KAAA,GAAW,SAAS,aAAa,KAAK;EAC9D,OAAO;CACR,CAAC;CAGF,OAAO;AACR;AAEA,SAAS,aAAa,QAAmD;CACxE,IAAI,CAAC,SAAS,MAAM,KAAK,OAAO,OAAO,aAAa,UACnD;CAID,IAAI,OAAO,OAAO,aAAa,YAAY;EAC1C,MAAM,WAAqC;GAC1C,MAAM;GACN,UAAU,OAAO;GACjB,SAAS,OAAO,OAAO,YAAY,WAAW,OAAO,UAAU;EAChE;EACA,IAAI,OAAO,OAAO,gBAAgB,WAAW,SAAS,cAAc,OAAO;EAC3E,OAAO;CACR;CAGA,IAAI,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,kBAAkB,UAAU;EAChF,MAAM,WAAqC;GAC1C,MAAM;GACN,UAAU,OAAO;GACjB,eAAe,OAAO;GACtB,MAAM,OAAO;EACd;EACA,IAAI,SAAS,OAAO,cAAc,GACjC,SAAS,iBAAiB,OAAO;EAElC,IAAI,OAAO,OAAO,0BAA0B,UAC3C,SAAS,wBAAwB,OAAO;EAEzC,IAAI,SAAS,OAAO,QAAQ,GAC3B,SAAS,WAAW,OAAO;EAE5B,OAAO;CACR;AAID;AAEA,SAAS,mBAAmB,SAA0D;CACrF,IACC,CAAC,SAAS,OAAO,KACjB,OAAO,QAAQ,eAAe,YAC9B,CAAC,SAAS,QAAQ,MAAM,KACxB,CAAC,MAAM,QAAQ,QAAQ,WAAW,GAElC;CAGD,MAAM,aAAa;CACnB,OAAO;EACN,YAAY,WAAW;EACvB,QAAQ,OAAO,OAAO,WAAW,MAAM;EACvC,aAAa,WAAW,YAAY,KAAK,gBAAgB;GACxD,MAAM,WAAW;GACjB,IAAI,WAAW;GACf,gBAAgB,WAAW;GAC3B,UAAU,OAAO,WAAW,UAAU;EACvC,EAAE;CACH;AACD;AAEA,SAAS,WAAW,MAAwC;CAC3D,wBAAA,yBAAyB,MAAM,SAAS,MAAM,QAAQ,UAAU,EAAE;CAClE,MAAM,SAA6B;EAClC,MAAM,KAAK;EACX,SAAS,KAAK;EACd,OAAO,UAAU,KAAK,KAAK;EAC3B,UAAU,KAAK,SAAS,KAAK,iBAAiB;GAC7C,WAAW,YAAY;GACvB,gBAAgB,CAAC,GAAG,YAAY,cAAc;EAC/C,EAAE;EACF,OAAO,KAAK;EACZ,iBAAiB,KAAK;CACvB;CACA,IAAI,KAAK,YAAY,KAAA,GAAW,OAAO,UAAU,KAAK;CACtD,IAAI,KAAK,kBAAkB,KAAA,GAAW,OAAO,gBAAgB,KAAK;CAClE,IAAI,KAAK,oBAAoB,KAAA,GAAW,OAAO,kBAAkB,UAAU,KAAK,eAAe;CAC/F,IAAI,KAAK,4BAA4B,OAAO,6BAA6B,CAAC,GAAG,KAAK,0BAA0B;CAC5G,IAAI,KAAK,OAAO,OAAO,QAAQ,UAAU,KAAK,KAAK;CACnD,OAAO;AACR;;;;;;;;;;;;;;;AAgBA,SAAgB,qBAAqB,QAA+C;CACnF,MAAM,WAA2B;EAChC,iBAAA;EACA,WAAW,OAAO;EAClB,eAAe,OAAO,gBAAgB,CAAC,EAAA,CAAG,IAAI,gBAAgB;EAC9D,cAAc,OAAO,eAAe,CAAC,EAAA,CAAG,IAAI,gBAAgB;EAC5D,cAAc,CAAC,GAAI,OAAO,gBAAgB,CAAC,CAAE;EAC7C,aAAa,OAAO,cAAc,CAAC,EAAA,CAAG,KAAK,kBAAkB;GAC5D,QAAQ,aAAa;GACrB,MAAM,aAAa;EACpB,EAAE;EACF,aAAa,OAAO,cAAc,CAAC,EAAA,CAAG,IAAI,eAAe;EACzD,UAAU,OAAO,WAAW,CAAC,EAAA,CAAG,IAAI,YAAY;EAChD,WAAW,OAAO,YAAY,CAAC,EAAA,CAC7B,IAAI,YAAY,CAAC,CACjB,QAAQ,WAA2C,WAAW,KAAA,CAAS;EACzE,gBAAgB,OAAO,iBAAiB,CAAC,EAAA,CACvC,IAAI,kBAAkB,CAAC,CACvB,QAAQ,YAAmD,YAAY,KAAA,CAAS;EAClF,QAAQ,OAAO,SAAS,CAAC,EAAA,CAAG,IAAI,UAAU;CAC3C;CAEA,IAAI,OAAO,YAAY,KAAA,GAAW,SAAS,UAAU,OAAO;CAC5D,IAAI,OAAO,gBAAgB,KAAA,GAAW,SAAS,cAAc,OAAO;CACpE,IAAI,OAAO,gBAAgB,KAAA,GAAW,SAAS,cAAc,OAAO;CACpE,IAAI,OAAO,eAAe,KAAA,GAAW,SAAS,aAAa,UAAU,OAAO,UAAU;CAEtF,OAAO;AACR;;;;;AAMA,SAAgB,2BACf,SACuB;CACvB,OAAO;EACN,iBAAA;EACA,SAAS,QAAQ,IAAI,oBAAoB;CAC1C;AACD"}

package/dist/manifest/index.d.cts

@@ -52,6 +52,7 @@ export interface ModuleManifestAction extends SurfaceDeclaration {
   policies?: string[];
   requiredRoles?: string[];
   requiredPermissions?: string[];
+  stagesInvocations?: string[];
   eventPhase?: "before_adapters" | "after_adapters";
   finalization?: {
     protocol: "atomic-after-adapters-v1";