@fabricorg/platform 1.16.0 → 1.17.0

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @fabricorg/platform
 
+## 1.17.0
+
+### Minor Changes
+
+- 7cb17c9: Add `RetryableHandlerError` and cross-copy recognition, plus optional confirmed rollback
+  retry inside one Host execution attempt. The default budget is three total tries (1–10).
+  Host requires a handler-call throw, identical-cause `ConfirmedTransactionRollback`, no adapter
+  or handoff evidence, fresh durable-derived inputs and transaction-scoped ownership fencing.
+  Policy evaluations, obligations, approvals and worker claim counts are retained; exhaustion
+  settles the last handler error through the existing redactor and statuses. Governance
+  `RetryableExecutionError`, returned failures and non-handler callback/commit errors retain
+  their existing failure semantics.
+
+  Expose `handlerRetry` classification, bounded jitter/delay and retry notification options,
+  and `isTransientPostgresTransactionError` for candidate SQLSTATE classification. Application
+  transaction providers can opt into rollback confirmation after successful rollback of a failed
+  callback. Built-in stores expose evidence for Host's internal handler callback request and
+  preserve prior error contracts for ordinary application transactions, approval, erasure and
+  other Host APIs, including callback-error identity and erasure's SQLSTATE mappings. Memory confirms after a configured provider's successful snapshot/restore
+  and ledger undo; commit failures and providerless internal transactions are not confirmed.
+  Custom stores exposing confirmation from their public transaction API remain supported through
+  normalization at non-handler Host and conformance boundaries. Retried callbacks must keep
+  effects inside the supplied transaction.
+
+  Retry observers run without awaiting them; synchronous throws and asynchronous rejections
+  are ignored. Memory rollback failures cannot authorize handler retry.
+
+- 1e46ff0: Add opt-in `idempotency.recordRefusals` to reserve keyed terminal submission refusals.
+  The new `submission_refused` status is inert, and refusal identity includes actor type.
+  Defaults retain the free-key refusal behavior. Admission-declaring actions omit refusal
+  digests to preserve their pre-admission parameter boundary; refusal rows store fixed evidence
+  without parameters, proposal or provenance attributes. Recorded errors confirm persistence,
+  and store failures surface unchanged. Apply migration 15 and upgrade all hosts sharing a
+  database before activation. Unauthorized callers can occupy keys, and callbacks returning
+  false during outages can permanently reserve them. Refusal codes must be fixed action codes.
+
+  With recording enabled, an empty string is a present idempotency key. Stores preserve empty
+  key and authorization-binding identities on hydration, and memory insertion arbitrates empty
+  keys consistently with PostgreSQL. Default Host submissions keep their keyless empty-string behavior.
+
+  Generic creation and status-update methods reject `submission_refused` as a write input;
+  the narrow refusal insert owns new refusal rows and their fixed payloads.
+
+  Validate request-only metadata before recording an eligible refusal so malformed submissions
+  leave their keys free. The public tenant-isolation kit adds an optional recorded-refusal scope
+  check, including ordinary creation against a refusal in another scope. Its result list gains
+  `fabric.tenancy.submission-refusal-scoped.v1`; stores without the method skip that check.
+  A PostgreSQL store must have migration 15 applied (`ensureSchema()`) before running the kit, or the new check fails.
+
 ## 1.16.0
 
 ### Minor Changes

package/README.md

@@ -130,7 +130,7 @@ const json = JSON.stringify(manifest, null, 2);
 
 An entity schema does not validate arbitrary writes through `TDb`. Persisted-record validation requires an explicit Host/database adapter. For actions without `finalize`, when an action declares `resultSchema`, Platform Host validates the public result after the handler and before events or adapters; failure rolls back domain writes only when the Host store has a transaction provider that includes them.
 
-An action may also declare `admitSubmission`, an async check that decides whether a submission may be recorded at all. It receives the trusted `tenantId`, `spaceId`, `actorId` and `actorType`, the submitted parameters and a `signal` (`ActionAdmissionSignal`, a structural subset of `AbortSignal`; Host passes a real one), and answers `{ admitted: true }` or `{ admitted: false, code }` with a fixed code. `@fabricorg/platform-host` 7.3.0 and later runs it after authorizing the submitter and before writing anything for the submission, refuses on a throw, timeout or any other answer, and passes the admission time to the handler as `ActionContext.admittedAt`. An older host ignores the field, so a handler that relies on it should refuse without `ctx.admittedAt`. Registration rejects an `admitSubmission` that is not a function.
+An action may also declare `admitSubmission`, an async check that decides whether submission parameters may be recorded. It receives the trusted `tenantId`, `spaceId`, `actorId` and `actorType`, the submitted parameters and a `signal` (`ActionAdmissionSignal`, a structural subset of `AbortSignal`; Host passes a real one), and answers `{ admitted: true }` or `{ admitted: false, code }` with a fixed code. `@fabricorg/platform-host` 7.3.0 and later runs it after authorizing the submitter and before persisting parameters, refuses on a throw, timeout or any other answer, and passes the admission time to the handler as `ActionContext.admittedAt`. An older host ignores the field, so a handler that relies on it should refuse without `ctx.admittedAt`. Registration rejects an `admitSubmission` that is not a function. Host defaults to writing nothing for a refused submission. Opt-in `idempotency.recordRefusals` reserves keyed definitive refusals with fixed evidence and empty parameters; see the [Host refusal contract](../platform-host/README.md#opt-in-recorded-submission-refusals) for identity, digest and rollout rules.
 
 ## The action lifecycle
 
@@ -145,7 +145,7 @@ Every `invokeAction(id, params)` call goes through:
    leased, idempotent invocation below its `retryableExecutionMaxAttempts` cap (default 5), after
    lease expiry, before policy evidence is written. Inline execution, non-idempotent actions,
    approval resume, and exhausted attempts fail terminally. Obligation resolution and persistence
-   are outside this retry region. This signal does not change handler or adapter retry behavior. Host also applies
+   are outside this governance retry region. `RetryableExecutionError` does not opt a handler into rollback retry. Host also applies
    `recoveryMaxAttempts` before resumed leased execution. It uses the same claim counter and defaults
    to `max(5, retryableExecutionMaxAttempts)`. An explicit lower recovery cap is rejected.
 
@@ -611,3 +611,15 @@ See the Platform Host README for cooperative cancellation and failure semantics.
 ## License
 
 MIT
+
+### Handler rollback retry signal
+
+`RetryableHandlerError` and `isRetryableHandlerError` are exported from the root and `/policies`.
+The error has stable name `RetryableHandlerError` and code `HANDLER_RETRYABLE`, recognized across
+ESM/CommonJS copies. Throw it to assert that effects stayed in the supplied Host transaction.
+Platform Host can retry after confirmed rollback, within the same attempt, subject to ownership,
+adapter-evidence and input-copy guards. `handlerRetry` defaults to three total tries (1–10).
+A classifier can opt raw errors in; it asserts safety for the whole retried unit. Transaction
+callbacks and handlers must keep effects inside that transaction when opting into retry.
+See `packages/platform-host/README.md` (Retry a rolled-back handler transaction) for provider
+confirmation, exclusions, delay options, recovery and terminal settlement.

package/dist/actions/index.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.cjs","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/** Host support for private, durable finalizing-action adapter preparation. */\n\tadapterPreparationProtocol?: \"v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\n/** A descendant invocation the Host durably stages with its parent mutation. */\nexport interface StagedInvocationRequest {\n\t/** Stable identity within one parent invocation. */\n\treadonly key: string;\n\treadonly actionId: ActionId;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\t/**\n\t * Private strict-JSON plain-object input for finalizing actions' adapter steps.\n\t * Passed as getInput's third argument; excluded from public results and finalize input.\n\t * The Host checkpoints it for recovery and removes it on terminal settlement,\n\t * retaining it while running or reconciliation_required. Requires Host capability v1.\n\t * Adapter inputs derived from it remain subject to the Host's redactAdapterInput option.\n\t */\n\tadapterPreparation?: Record<string, unknown>;\n\terror?: string;\n\t/** Host-owned descendants released only after this invocation completes. */\n\tstagedInvocations?: readonly StagedInvocationRequest[];\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n\t/** Additional descendants staged atomically with finalization and completion. */\n\treadonly stagedInvocations?: readonly StagedInvocationRequest[];\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\tconst result = handler ? await handler(ctx, params) : { success: true, data: {} };\n\t\tif (result.adapterPreparation !== undefined && ctx.adapterPreparationProtocol !== \"v1\")\n\t\t\tthrow new Error(\"Host does not support adapter preparation protocol v1.\");\n\t\treturn result;\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t\t/** Private preparation from a finalizing handler, absent when none was supplied. */\n\t\tadapterPreparation?: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Child action IDs this action is permitted to stage for post-completion dispatch. */\n\tstagesInvocations?: readonly ActionId[];\n\t/** Host-registered principal name used when dispatching each declared staged child. */\n\tstagedInvocationPrincipals?: Readonly<Record<ActionId, string>>;\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";;AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AA+JA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,MAAM,SAAS,UAAU,MAAM,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;GAChF,IAAI,OAAO,uBAAuB,KAAA,KAAa,IAAI,+BAA+B,MACjF,MAAM,IAAI,MAAM,wDAAwD;GACzE,OAAO;EACR;CAAE;AACH;;AAyBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAuJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}
+{"version":3,"file":"index.cjs","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\"\n\t| \"submission_refused\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/** Host support for private, durable finalizing-action adapter preparation. */\n\tadapterPreparationProtocol?: \"v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether submission parameters may be recorded. A supporting host\n * runs it after authorizing the submitter and before persisting parameters.\n * A refusal, throw, timeout or answer other than `{ admitted: true }` refuses\n * the submission. Platform Host defaults to writing nothing on refusal;\n * opt-in recorded refusals reserve a key with fixed evidence, without parameters.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\n/** A descendant invocation the Host durably stages with its parent mutation. */\nexport interface StagedInvocationRequest {\n\t/** Stable identity within one parent invocation. */\n\treadonly key: string;\n\treadonly actionId: ActionId;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\t/**\n\t * Private strict-JSON plain-object input for finalizing actions' adapter steps.\n\t * Passed as getInput's third argument; excluded from public results and finalize input.\n\t * The Host checkpoints it for recovery and removes it on terminal settlement,\n\t * retaining it while running or reconciliation_required. Requires Host capability v1.\n\t * Adapter inputs derived from it remain subject to the Host's redactAdapterInput option.\n\t */\n\tadapterPreparation?: Record<string, unknown>;\n\terror?: string;\n\t/** Host-owned descendants released only after this invocation completes. */\n\tstagedInvocations?: readonly StagedInvocationRequest[];\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n\t/** Additional descendants staged atomically with finalization and completion. */\n\treadonly stagedInvocations?: readonly StagedInvocationRequest[];\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\tconst result = handler ? await handler(ctx, params) : { success: true, data: {} };\n\t\tif (result.adapterPreparation !== undefined && ctx.adapterPreparationProtocol !== \"v1\")\n\t\t\tthrow new Error(\"Host does not support adapter preparation protocol v1.\");\n\t\treturn result;\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t\t/** Private preparation from a finalizing handler, absent when none was supplied. */\n\t\tadapterPreparation?: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on submission before recording parameters.\n\t * Platform Host can opt into reserving refused idempotency keys with fixed\n\t * refusal evidence; it does not digest parameters before admission passes.\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Child action IDs this action is permitted to stage for post-completion dispatch. */\n\tstagesInvocations?: readonly ActionId[];\n\t/** Host-registered principal name used when dispatching each declared staged child. */\n\tstagedInvocationPrincipals?: Readonly<Record<ActionId, string>>;\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";;AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AAiKA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,MAAM,SAAS,UAAU,MAAM,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;GAChF,IAAI,OAAO,uBAAuB,KAAA,KAAa,IAAI,+BAA+B,MACjF,MAAM,IAAI,MAAM,wDAAwD;GACzE,OAAO;EACR;CAAE;AACH;;AAyBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAwJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}

package/dist/actions/index.d.cts

@@ -22,7 +22,7 @@ export type ActorType = "natural_person" | "agent" | "system" | "service_account
 export declare const ACTOR_TYPES: readonly ActorType[];
 export declare function isActorType(value: string): value is ActorType;
 export declare function assertActorType(value: string): asserts value is ActorType;
-export type ActionStatus = "pending" | "running" | "completed" | "failed" | "blocked_by_policy" | "waiting_for_approval" | "reconciliation_required" | "validation_failed";
+export type ActionStatus = "pending" | "running" | "completed" | "failed" | "blocked_by_policy" | "waiting_for_approval" | "reconciliation_required" | "validation_failed" | "submission_refused";
 export interface FabricRuntimeServices {
   readonly [serviceName: string]: unknown;
 }
@@ -103,10 +103,11 @@ export type ActionAdmissionDecision = {
   readonly code: string;
 };
 /**
- * Decides whether a submission may be recorded at all. A host that supports
- * it runs the check after authorizing the submitter and before it writes
- * anything durable for the submission; a refusal, a throw, a timeout or any
- * answer other than `{ admitted: true }` refuses the submission.
+ * Decides whether submission parameters may be recorded. A supporting host
+ * runs it after authorizing the submitter and before persisting parameters.
+ * A refusal, throw, timeout or answer other than `{ admitted: true }` refuses
+ * the submission. Platform Host defaults to writing nothing on refusal;
+ * opt-in recorded refusals reserve a key with fixed evidence, without parameters.
  */
 export type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
 /** A descendant invocation the Host durably stages with its parent mutation. */
@@ -208,8 +209,9 @@ export interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
   version: number;
   schema: SchemaValidator;
   /**
-   * Optional check a host runs on every submission before it records
-   * anything durable for it (invocation, idempotency key, events, errors).
+   * Optional check a host runs on submission before recording parameters.
+   * Platform Host can opt into reserving refused idempotency keys with fixed
+   * refusal evidence; it does not digest parameters before admission passes.
    * Use it when parameters must be validated against trusted context, for
    * example a secret reference the tenant's secret store must hold, before
    * they may be persisted. `@fabricorg/platform-host` runs it from the

package/dist/actions/index.d.ts

@@ -22,7 +22,7 @@ export type ActorType = "natural_person" | "agent" | "system" | "service_account
 export declare const ACTOR_TYPES: readonly ActorType[];
 export declare function isActorType(value: string): value is ActorType;
 export declare function assertActorType(value: string): asserts value is ActorType;
-export type ActionStatus = "pending" | "running" | "completed" | "failed" | "blocked_by_policy" | "waiting_for_approval" | "reconciliation_required" | "validation_failed";
+export type ActionStatus = "pending" | "running" | "completed" | "failed" | "blocked_by_policy" | "waiting_for_approval" | "reconciliation_required" | "validation_failed" | "submission_refused";
 export interface FabricRuntimeServices {
   readonly [serviceName: string]: unknown;
 }
@@ -103,10 +103,11 @@ export type ActionAdmissionDecision = {
   readonly code: string;
 };
 /**
- * Decides whether a submission may be recorded at all. A host that supports
- * it runs the check after authorizing the submitter and before it writes
- * anything durable for the submission; a refusal, a throw, a timeout or any
- * answer other than `{ admitted: true }` refuses the submission.
+ * Decides whether submission parameters may be recorded. A supporting host
+ * runs it after authorizing the submitter and before persisting parameters.
+ * A refusal, throw, timeout or answer other than `{ admitted: true }` refuses
+ * the submission. Platform Host defaults to writing nothing on refusal;
+ * opt-in recorded refusals reserve a key with fixed evidence, without parameters.
  */
 export type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
 /** A descendant invocation the Host durably stages with its parent mutation. */
@@ -208,8 +209,9 @@ export interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
   version: number;
   schema: SchemaValidator;
   /**
-   * Optional check a host runs on every submission before it records
-   * anything durable for it (invocation, idempotency key, events, errors).
+   * Optional check a host runs on submission before recording parameters.
+   * Platform Host can opt into reserving refused idempotency keys with fixed
+   * refusal evidence; it does not digest parameters before admission passes.
    * Use it when parameters must be validated against trusted context, for
    * example a secret reference the tenant's secret store must hold, before
    * they may be persisted. `@fabricorg/platform-host` runs it from the

package/dist/actions/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/** Host support for private, durable finalizing-action adapter preparation. */\n\tadapterPreparationProtocol?: \"v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\n/** A descendant invocation the Host durably stages with its parent mutation. */\nexport interface StagedInvocationRequest {\n\t/** Stable identity within one parent invocation. */\n\treadonly key: string;\n\treadonly actionId: ActionId;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\t/**\n\t * Private strict-JSON plain-object input for finalizing actions' adapter steps.\n\t * Passed as getInput's third argument; excluded from public results and finalize input.\n\t * The Host checkpoints it for recovery and removes it on terminal settlement,\n\t * retaining it while running or reconciliation_required. Requires Host capability v1.\n\t * Adapter inputs derived from it remain subject to the Host's redactAdapterInput option.\n\t */\n\tadapterPreparation?: Record<string, unknown>;\n\terror?: string;\n\t/** Host-owned descendants released only after this invocation completes. */\n\tstagedInvocations?: readonly StagedInvocationRequest[];\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n\t/** Additional descendants staged atomically with finalization and completion. */\n\treadonly stagedInvocations?: readonly StagedInvocationRequest[];\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\tconst result = handler ? await handler(ctx, params) : { success: true, data: {} };\n\t\tif (result.adapterPreparation !== undefined && ctx.adapterPreparationProtocol !== \"v1\")\n\t\t\tthrow new Error(\"Host does not support adapter preparation protocol v1.\");\n\t\treturn result;\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t\t/** Private preparation from a finalizing handler, absent when none was supplied. */\n\t\tadapterPreparation?: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Child action IDs this action is permitted to stage for post-completion dispatch. */\n\tstagesInvocations?: readonly ActionId[];\n\t/** Host-registered principal name used when dispatching each declared staged child. */\n\tstagedInvocationPrincipals?: Readonly<Record<ActionId, string>>;\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AA+JA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,MAAM,SAAS,UAAU,MAAM,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;GAChF,IAAI,OAAO,uBAAuB,KAAA,KAAa,IAAI,+BAA+B,MACjF,MAAM,IAAI,MAAM,wDAAwD;GACzE,OAAO;EACR;CAAE;AACH;;AAyBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAuJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}
+{"version":3,"file":"index.js","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\"\n\t| \"submission_refused\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\tfinalizationProtocol?: \"atomic-after-adapters-v1\";\n\t/** Host support for private, durable finalizing-action adapter preparation. */\n\tadapterPreparationProtocol?: \"v1\";\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether submission parameters may be recorded. A supporting host\n * runs it after authorizing the submitter and before persisting parameters.\n * A refusal, throw, timeout or answer other than `{ admitted: true }` refuses\n * the submission. Platform Host defaults to writing nothing on refusal;\n * opt-in recorded refusals reserve a key with fixed evidence, without parameters.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\n/** A descendant invocation the Host durably stages with its parent mutation. */\nexport interface StagedInvocationRequest {\n\t/** Stable identity within one parent invocation. */\n\treadonly key: string;\n\treadonly actionId: ActionId;\n\treadonly parameters: Record<string, unknown>;\n}\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\t/**\n\t * Private strict-JSON plain-object input for finalizing actions' adapter steps.\n\t * Passed as getInput's third argument; excluded from public results and finalize input.\n\t * The Host checkpoints it for recovery and removes it on terminal settlement,\n\t * retaining it while running or reconciliation_required. Requires Host capability v1.\n\t * Adapter inputs derived from it remain subject to the Host's redactAdapterInput option.\n\t */\n\tadapterPreparation?: Record<string, unknown>;\n\terror?: string;\n\t/** Host-owned descendants released only after this invocation completes. */\n\tstagedInvocations?: readonly StagedInvocationRequest[];\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport type FinalizationJson = null | boolean | number | string | readonly FinalizationJson[] | { readonly [key: string]: FinalizationJson };\nexport type FinalizationRecord = { readonly [key: string]: FinalizationJson };\nexport type ActionFinalizationContext<TDb = unknown> = Pick<ActionContext<TDb>,\n\t\"actionInvocationId\" | \"tenantId\" | \"spaceId\" | \"actorId\" | \"actorType\" |\n\t\"correlationId\" | \"causationId\" | \"provenance\" | \"db\">;\nexport type ActionFinalizationStep = {\n\treadonly stepIndex: number;\n\treadonly adapterType: string;\n\treadonly operation: string;\n} & ({ readonly status: \"succeeded\"; readonly adapterInvocationId: string; readonly output: FinalizationRecord } |\n\t{ readonly status: \"skipped\" });\nexport interface ActionFinalizationInput {\n\treadonly params: FinalizationJson;\n\treadonly handlerData: FinalizationRecord;\n\treadonly adapterOutputs: readonly ActionFinalizationStep[];\n}\nexport interface ActionFinalizationEvent {\n\treadonly eventType: string;\n\treadonly subjectType: string;\n\treadonly subjectId: string;\n\treadonly payload: FinalizationJson;\n\treadonly eventSchemaVersion?: number;\n}\nexport interface ActionFinalizationResult {\n\treadonly events?: readonly ActionFinalizationEvent[];\n\treadonly resultPatch?: FinalizationRecord;\n\t/** Additional descendants staged atomically with finalization and completion. */\n\treadonly stagedInvocations?: readonly StagedInvocationRequest[];\n}\nexport type ActionFinalizer<TDb = unknown> = (\n\tctx: ActionFinalizationContext<TDb>, input: ActionFinalizationInput,\n) => Promise<ActionFinalizationResult>;\n\n/** Validate declarations at registration and at dynamically resolved execution boundaries. */\nexport function assertActionFinalization<TDb>(action: Pick<ActionDefinition<TDb>, \"actionId\" | \"finalize\" | \"eventPhase\" | \"kind\" | \"execution\">): void {\n\tif (action.finalize === undefined) return;\n\tif (typeof action.finalize !== \"function\") throw new Error(\"Action finalization hook must be a function.\");\n\tif (action.eventPhase !== \"after_adapters\") throw new Error(\"Action finalization requires eventPhase after_adapters.\");\n\tif (action.kind !== undefined && action.kind !== \"atomic\") throw new Error(\"Action finalization requires an atomic action.\");\n\tif (action.execution?.completion !== undefined && action.execution.completion !== \"immediate\") throw new Error(\"Action finalization requires immediate completion.\");\n}\n\n/** Refuse older hosts before application handler code executes. Use for distributed finalizing actions. */\nexport function defineFinalizingAction<TDb>(action: ActionDefinition<TDb> & { finalize: ActionFinalizer<TDb> }): ActionDefinition<TDb> {\n\tassertActionFinalization(action);\n\tconst handler = action.handler;\n\treturn { ...action, handler: async (ctx, params) => {\n\t\tif (ctx.finalizationProtocol !== \"atomic-after-adapters-v1\") throw new Error(\"Host does not support atomic-after-adapters-v1 finalization.\");\n\t\tconst result = handler ? await handler(ctx, params) : { success: true, data: {} };\n\t\tif (result.adapterPreparation !== undefined && ctx.adapterPreparationProtocol !== \"v1\")\n\t\t\tthrow new Error(\"Host does not support adapter preparation protocol v1.\");\n\t\treturn result;\n\t} };\n}\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\t/** Positive finite integer duration in milliseconds; overrides Host adapterDeadlineMs for this step. */\n\tdeadlineMs?: number;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t\t/** Private preparation from a finalizing handler, absent when none was supplied. */\n\t\tadapterPreparation?: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\n/** Validate optional step execution budgets before accepting or executing an action. */\nexport function assertAdapterStepDeadlines(action: { actionId: string; adapterSteps?: readonly Pick<AdapterStep, \"deadlineMs\">[] }): void {\n\tfor (const step of action.adapterSteps ?? []) {\n\t\tif (step.deadlineMs !== undefined && (!Number.isInteger(step.deadlineMs) || step.deadlineMs <= 0)) {\n\t\t\tthrow new Error(`Action \"${action.actionId}\" adapter step deadlineMs must be a positive finite integer.`);\n\t\t}\n\t}\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on submission before recording parameters.\n\t * Platform Host can opt into reserving refused idempotency keys with fixed\n\t * refusal evidence; it does not digest parameters before admission passes.\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\tfinalize?: ActionFinalizer<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Child action IDs this action is permitted to stage for post-completion dispatch. */\n\tstagesInvocations?: readonly ActionId[];\n\t/** Host-registered principal name used when dispatching each declared staged child. */\n\tstagedInvocationPrincipals?: Readonly<Record<ActionId, string>>;\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tassertAdapterStepDeadlines(definition);\n\t\tassertActionFinalization(definition);\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;;AAiKA,SAAgB,yBAA8B,QAA0G;CACvJ,IAAI,OAAO,aAAa,KAAA,GAAW;CACnC,IAAI,OAAO,OAAO,aAAa,YAAY,MAAM,IAAI,MAAM,8CAA8C;CACzG,IAAI,OAAO,eAAe,kBAAkB,MAAM,IAAI,MAAM,yDAAyD;CACrH,IAAI,OAAO,SAAS,KAAA,KAAa,OAAO,SAAS,UAAU,MAAM,IAAI,MAAM,gDAAgD;CAC3H,IAAI,OAAO,WAAW,eAAe,KAAA,KAAa,OAAO,UAAU,eAAe,aAAa,MAAM,IAAI,MAAM,oDAAoD;AACpK;;AAGA,SAAgB,uBAA4B,QAA2F;CACtI,yBAAyB,MAAM;CAC/B,MAAM,UAAU,OAAO;CACvB,OAAO;EAAE,GAAG;EAAQ,SAAS,OAAO,KAAK,WAAW;GACnD,IAAI,IAAI,yBAAyB,4BAA4B,MAAM,IAAI,MAAM,8DAA8D;GAC3I,MAAM,SAAS,UAAU,MAAM,QAAQ,KAAK,MAAM,IAAI;IAAE,SAAS;IAAM,MAAM,CAAC;GAAE;GAChF,IAAI,OAAO,uBAAuB,KAAA,KAAa,IAAI,+BAA+B,MACjF,MAAM,IAAI,MAAM,wDAAwD;GACzE,OAAO;EACR;CAAE;AACH;;AAyBA,SAAgB,2BAA2B,QAA+F;CACzI,KAAK,MAAM,QAAQ,OAAO,gBAAgB,CAAC,GAC1C,IAAI,KAAK,eAAe,KAAA,MAAc,CAAC,OAAO,UAAU,KAAK,UAAU,KAAK,KAAK,cAAc,IAC9F,MAAM,IAAI,MAAM,WAAW,OAAO,SAAS,6DAA6D;AAG3G;AAwJA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,2BAA2B,UAAU;EACrC,yBAAyB,UAAU;EACnC,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}

package/dist/{index-CVHA1ypT.d.cts → index-CxhI1dlJ.d.cts}

@@ -1,4 +1,16 @@
 import { ActionId, ActorType, FabricRuntimeServices } from "./actions/index.cjs";
+//#region policies/retryable-handler.d.ts
+/** Assert that this handler's effects stayed inside the Host transaction and it can run again after rollback. */
+declare class RetryableHandlerError extends Error {
+  readonly name = "RetryableHandlerError";
+  readonly code: "HANDLER_RETRYABLE";
+  constructor(message: string, options?: {
+    cause?: unknown;
+  });
+}
+/** Recognise the signal across package copies, including ESM and CommonJS. */
+declare function isRetryableHandlerError(error: unknown): error is RetryableHandlerError;
+//#endregion
 //#region policies/reconciliation-required.d.ts
 /** A possibly committed domain effect requiring an operator decision at the handler transaction boundary. */
 declare class ReconciliationRequiredError extends Error {
@@ -259,4 +271,4 @@ declare function evaluatePolicyDefinition(policy: RuntimePolicyDefinition, ctx:
 declare function validateDataPolicyDefinition(definition: DataPolicyDefinition): DataPolicyValidationResult;
 declare function aggregatePolicyOutcomes(outcomes: PolicyOutcome[]): PolicyOutcome | undefined;
 //#endregion
-export { RuntimePolicyDefinition as A, isRetryableExecutionError as B, PolicyId as C, PolicyNavigateCorrectiveAction as D, PolicyManualCorrectiveAction as E, evaluatePolicyDefinitions as F, isReconciliationRequiredError as H, evaluateRegisteredPolicies as I, validateDataPolicyDefinition as L, assertPolicyId as M, createPolicyRegistry as N, PolicyOutcome as O, evaluatePolicyDefinition as P, validatePolicyGuidance as R, PolicyGuidanceValidationResult as S, PolicyKind as T, ReconciliationRequiredError as V, PolicyEvaluator as _, DataPolicyLiteral as a, PolicyFallbackTrigger as b, DataPolicyValidationResult as c, PolicyCorrectiveAction as d, PolicyCorrectiveActionBase as f, PolicyEvaluationResult as g, PolicyEvaluationMode as h, DataPolicyDefinition as i, aggregatePolicyOutcomes as j, PolicyRegistry as k, PolicyAuthorityReference as l, PolicyDispatchEvidence as m, DataPolicyCondition as n, DataPolicySource as o, PolicyCorrectiveActionKind as p, DataPolicyConditionResult as r, DataPolicySourceReference as s, DataPolicyComparisonOperator as t, PolicyContext as u, PolicyFact as v, PolicyInvokeActionCorrectiveAction as w, PolicyGuidance as x, PolicyFallbackDefinition as y, RetryableExecutionError as z };
+export { RuntimePolicyDefinition as A, isRetryableExecutionError as B, PolicyId as C, PolicyNavigateCorrectiveAction as D, PolicyManualCorrectiveAction as E, evaluatePolicyDefinitions as F, isReconciliationRequiredError as H, evaluateRegisteredPolicies as I, validateDataPolicyDefinition as L, assertPolicyId as M, createPolicyRegistry as N, PolicyOutcome as O, evaluatePolicyDefinition as P, validatePolicyGuidance as R, PolicyGuidanceValidationResult as S, PolicyKind as T, RetryableHandlerError as U, ReconciliationRequiredError as V, isRetryableHandlerError as W, PolicyEvaluator as _, DataPolicyLiteral as a, PolicyFallbackTrigger as b, DataPolicyValidationResult as c, PolicyCorrectiveAction as d, PolicyCorrectiveActionBase as f, PolicyEvaluationResult as g, PolicyEvaluationMode as h, DataPolicyDefinition as i, aggregatePolicyOutcomes as j, PolicyRegistry as k, PolicyAuthorityReference as l, PolicyDispatchEvidence as m, DataPolicyCondition as n, DataPolicySource as o, PolicyCorrectiveActionKind as p, DataPolicyConditionResult as r, DataPolicySourceReference as s, DataPolicyComparisonOperator as t, PolicyContext as u, PolicyFact as v, PolicyInvokeActionCorrectiveAction as w, PolicyGuidance as x, PolicyFallbackDefinition as y, RetryableExecutionError as z };

package/dist/{index-sPUPs8pr.d.ts → index-DCaegG3v.d.ts}

@@ -1,4 +1,16 @@
 import { ActionId, ActorType, FabricRuntimeServices } from "./actions/index.js";
+//#region policies/retryable-handler.d.ts
+/** Assert that this handler's effects stayed inside the Host transaction and it can run again after rollback. */
+declare class RetryableHandlerError extends Error {
+  readonly name = "RetryableHandlerError";
+  readonly code: "HANDLER_RETRYABLE";
+  constructor(message: string, options?: {
+    cause?: unknown;
+  });
+}
+/** Recognise the signal across package copies, including ESM and CommonJS. */
+declare function isRetryableHandlerError(error: unknown): error is RetryableHandlerError;
+//#endregion
 //#region policies/reconciliation-required.d.ts
 /** A possibly committed domain effect requiring an operator decision at the handler transaction boundary. */
 declare class ReconciliationRequiredError extends Error {
@@ -259,4 +271,4 @@ declare function evaluatePolicyDefinition(policy: RuntimePolicyDefinition, ctx:
 declare function validateDataPolicyDefinition(definition: DataPolicyDefinition): DataPolicyValidationResult;
 declare function aggregatePolicyOutcomes(outcomes: PolicyOutcome[]): PolicyOutcome | undefined;
 //#endregion
-export { RuntimePolicyDefinition as A, isRetryableExecutionError as B, PolicyId as C, PolicyNavigateCorrectiveAction as D, PolicyManualCorrectiveAction as E, evaluatePolicyDefinitions as F, isReconciliationRequiredError as H, evaluateRegisteredPolicies as I, validateDataPolicyDefinition as L, assertPolicyId as M, createPolicyRegistry as N, PolicyOutcome as O, evaluatePolicyDefinition as P, validatePolicyGuidance as R, PolicyGuidanceValidationResult as S, PolicyKind as T, ReconciliationRequiredError as V, PolicyEvaluator as _, DataPolicyLiteral as a, PolicyFallbackTrigger as b, DataPolicyValidationResult as c, PolicyCorrectiveAction as d, PolicyCorrectiveActionBase as f, PolicyEvaluationResult as g, PolicyEvaluationMode as h, DataPolicyDefinition as i, aggregatePolicyOutcomes as j, PolicyRegistry as k, PolicyAuthorityReference as l, PolicyDispatchEvidence as m, DataPolicyCondition as n, DataPolicySource as o, PolicyCorrectiveActionKind as p, DataPolicyConditionResult as r, DataPolicySourceReference as s, DataPolicyComparisonOperator as t, PolicyContext as u, PolicyFact as v, PolicyInvokeActionCorrectiveAction as w, PolicyGuidance as x, PolicyFallbackDefinition as y, RetryableExecutionError as z };
+export { RuntimePolicyDefinition as A, isRetryableExecutionError as B, PolicyId as C, PolicyNavigateCorrectiveAction as D, PolicyManualCorrectiveAction as E, evaluatePolicyDefinitions as F, isReconciliationRequiredError as H, evaluateRegisteredPolicies as I, validateDataPolicyDefinition as L, assertPolicyId as M, createPolicyRegistry as N, PolicyOutcome as O, evaluatePolicyDefinition as P, validatePolicyGuidance as R, PolicyGuidanceValidationResult as S, PolicyKind as T, RetryableHandlerError as U, ReconciliationRequiredError as V, isRetryableHandlerError as W, PolicyEvaluator as _, DataPolicyLiteral as a, PolicyFallbackTrigger as b, DataPolicyValidationResult as c, PolicyCorrectiveAction as d, PolicyCorrectiveActionBase as f, PolicyEvaluationResult as g, PolicyEvaluationMode as h, DataPolicyDefinition as i, aggregatePolicyOutcomes as j, PolicyRegistry as k, PolicyAuthorityReference as l, PolicyDispatchEvidence as m, DataPolicyCondition as n, DataPolicySource as o, PolicyCorrectiveActionKind as p, DataPolicyConditionResult as r, DataPolicySourceReference as s, DataPolicyComparisonOperator as t, PolicyContext as u, PolicyFact as v, PolicyInvokeActionCorrectiveAction as w, PolicyGuidance as x, PolicyFallbackDefinition as y, RetryableExecutionError as z };

package/dist/index.cjs

@@ -8,7 +8,7 @@ const require_objects_index = require("./objects/index.cjs");
 const require_projections_index = require("./projections/index.cjs");
 const require_modules_index = require("./modules/index.cjs");
 const require_manifest_index = require("./manifest/index.cjs");
-const require_policies = require("./policies-Nxbp1CH8.cjs");
+const require_policies = require("./policies-Cz1apiaK.cjs");
 const require_state_machines_index = require("./state-machines/index.cjs");
 const require_engine = require("./engine-T6yBlzOE.cjs");
 const require_privacy_index = require("./privacy/index.cjs");
@@ -38,6 +38,7 @@ exports.MissingAdapterRegistrationError = require_adapters_index.MissingAdapterR
 exports.PLATFORM_PRIVACY_POLICY_VERSION = require_privacy_index.PLATFORM_PRIVACY_POLICY_VERSION;
 exports.ReconciliationRequiredError = require_policies.ReconciliationRequiredError;
 exports.RetryableExecutionError = require_policies.RetryableExecutionError;
+exports.RetryableHandlerError = require_policies.RetryableHandlerError;
 exports.STRICT_EXECUTION_CONTRACT_PROFILE = require_certification_index.STRICT_EXECUTION_CONTRACT_PROFILE;
 exports.STRICT_EXECUTION_CONTRACT_PROFILE_ID = require_certification_index.STRICT_EXECUTION_CONTRACT_PROFILE_ID;
 exports.aggregatePolicyOutcomes = require_policies.aggregatePolicyOutcomes;
@@ -93,6 +94,7 @@ exports.isFabricId = require_ids_index.isFabricId;
 exports.isJsonSchemaExportableValidator = require_manifest_index.isJsonSchemaExportableValidator;
 exports.isReconciliationRequiredError = require_policies.isReconciliationRequiredError;
 exports.isRetryableExecutionError = require_policies.isRetryableExecutionError;
+exports.isRetryableHandlerError = require_policies.isRetryableHandlerError;
 exports.normalizeModuleManifest = require_manifest_index.normalizeModuleManifest;
 exports.normalizeModuleManifestBundle = require_manifest_index.normalizeModuleManifestBundle;
 exports.parseFabricId = require_ids_index.parseFabricId;

package/dist/index.d.cts

@@ -3,7 +3,7 @@ import { ACTOR_TYPES, ActionAdmission, ActionAdmissionDecision, ActionAdmissionI
 import { AcceptedExternalOperation, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionLease, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, ExecuteWithRetryOptions, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, MissingAdapterRegistrationError, ResolvedAdapterRetryPolicy, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, classifyAdapterOutcome, classifyCircuitBreakerOutcome, executeWithAdapterRetry, getRetryDelayMs, isAdapterCircuitOpenError, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome } from "./adapters/index.cjs";
 import { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from "./agent-hitl/index.cjs";
 import { a as ObjectTypeRegistry, c as assertPortableJsonSchema, i as JsonValue, l as createObjectTypeRegistry, n as JsonPrimitive, o as PortableJsonSchema, r as JsonSchemaValidationIssue, s as assertObjectType, t as FabricObjectType, u as validatePortableJson } from "./index-DZ4mnNb7.cjs";
-import { A as RuntimePolicyDefinition, B as isRetryableExecutionError, C as PolicyId, D as PolicyNavigateCorrectiveAction, E as PolicyManualCorrectiveAction, F as evaluatePolicyDefinitions, H as isReconciliationRequiredError, I as evaluateRegisteredPolicies, L as validateDataPolicyDefinition, M as assertPolicyId, N as createPolicyRegistry, O as PolicyOutcome, P as evaluatePolicyDefinition, R as validatePolicyGuidance, S as PolicyGuidanceValidationResult, T as PolicyKind, V as ReconciliationRequiredError, _ as PolicyEvaluator, a as DataPolicyLiteral, b as PolicyFallbackTrigger, c as DataPolicyValidationResult, d as PolicyCorrectiveAction, f as PolicyCorrectiveActionBase, g as PolicyEvaluationResult, h as PolicyEvaluationMode, i as DataPolicyDefinition, j as aggregatePolicyOutcomes, k as PolicyRegistry, l as PolicyAuthorityReference, m as PolicyDispatchEvidence, n as DataPolicyCondition, o as DataPolicySource, p as PolicyCorrectiveActionKind, r as DataPolicyConditionResult, s as DataPolicySourceReference, t as DataPolicyComparisonOperator, u as PolicyContext, v as PolicyFact, w as PolicyInvokeActionCorrectiveAction, x as PolicyGuidance, y as PolicyFallbackDefinition, z as RetryableExecutionError } from "./index-CVHA1ypT.cjs";
+import { A as RuntimePolicyDefinition, B as isRetryableExecutionError, C as PolicyId, D as PolicyNavigateCorrectiveAction, E as PolicyManualCorrectiveAction, F as evaluatePolicyDefinitions, H as isReconciliationRequiredError, I as evaluateRegisteredPolicies, L as validateDataPolicyDefinition, M as assertPolicyId, N as createPolicyRegistry, O as PolicyOutcome, P as evaluatePolicyDefinition, R as validatePolicyGuidance, S as PolicyGuidanceValidationResult, T as PolicyKind, U as RetryableHandlerError, V as ReconciliationRequiredError, W as isRetryableHandlerError, _ as PolicyEvaluator, a as DataPolicyLiteral, b as PolicyFallbackTrigger, c as DataPolicyValidationResult, d as PolicyCorrectiveAction, f as PolicyCorrectiveActionBase, g as PolicyEvaluationResult, h as PolicyEvaluationMode, i as DataPolicyDefinition, j as aggregatePolicyOutcomes, k as PolicyRegistry, l as PolicyAuthorityReference, m as PolicyDispatchEvidence, n as DataPolicyCondition, o as DataPolicySource, p as PolicyCorrectiveActionKind, r as DataPolicyConditionResult, s as DataPolicySourceReference, t as DataPolicyComparisonOperator, u as PolicyContext, v as PolicyFact, w as PolicyInvokeActionCorrectiveAction, x as PolicyGuidance, y as PolicyFallbackDefinition, z as RetryableExecutionError } from "./index-CxhI1dlJ.cjs";
 import { a as StateMachineRegistry, c as evaluateStateMachineTransition, i as StateMachineDefinition, l as validateStateMachineTransition, n as StateDefinition, o as TransitionContext, r as StateMachineDatabaseClient, s as createStateMachineRegistry, t as StateClass } from "./index-fmUiRBXu.cjs";
 import { a as ReplayViewOptions, c as ReplayableAssetEvent, d as ViewRegistry, f as ViewUsageMetadata, g as viewContractKey, h as replayView, i as ReplaySnapshot, l as ViewContract, m as replayEvents, n as ReplayEventsResult, o as ReplayWarning, p as createViewRegistry, r as ReplayScope, s as ReplayWarningCode, t as ReplayEventsOptions, u as ViewEventConsumption } from "./index-9jasmw76.cjs";
 import { CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DeclarativeInvariant, EventTypeRegistration, EventTypeRegistrationInput, FabricModule, IdPrefixRegistration, InvariantEnforcement, ModuleDependency, ModuleDependencyInput, ModuleRegistry, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, PolicyRegistration, StateMachineRegistration, createModuleRegistry, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, registerFabricModule, registerFabricModules, validateAndOrderFabricModules, validateModuleNamespace } from "./modules/index.cjs";
@@ -15,4 +15,4 @@ import { C as AnonymizationPolicy, D as stableChecksum, E as FieldRedactor, S as
 import { ExecutionAttestation, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, GovernanceRuntimeEvidence, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, PolicyObligation, PolicyObligationStatus, ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from "./governance/index.cjs";
 import { FABRIC_ID_PREFIXES, FabricIdPrefix, createFabricId, isFabricId, parseFabricId } from "./ids/index.cjs";
 import { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from "./testing/index.cjs";
-export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionLease, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };
+export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionLease, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RetryableHandlerError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, isRetryableHandlerError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { ACTOR_TYPES, ActionAdmission, ActionAdmissionDecision, ActionAdmissionI
 import { AcceptedExternalOperation, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionLease, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, ExecuteWithRetryOptions, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, MissingAdapterRegistrationError, ResolvedAdapterRetryPolicy, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, classifyAdapterOutcome, classifyCircuitBreakerOutcome, executeWithAdapterRetry, getRetryDelayMs, isAdapterCircuitOpenError, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome } from "./adapters/index.js";
 import { AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute } from "./agent-hitl/index.js";
 import { a as ObjectTypeRegistry, c as assertPortableJsonSchema, i as JsonValue, l as createObjectTypeRegistry, n as JsonPrimitive, o as PortableJsonSchema, r as JsonSchemaValidationIssue, s as assertObjectType, t as FabricObjectType, u as validatePortableJson } from "./index-DZ4mnNb7.js";
-import { A as RuntimePolicyDefinition, B as isRetryableExecutionError, C as PolicyId, D as PolicyNavigateCorrectiveAction, E as PolicyManualCorrectiveAction, F as evaluatePolicyDefinitions, H as isReconciliationRequiredError, I as evaluateRegisteredPolicies, L as validateDataPolicyDefinition, M as assertPolicyId, N as createPolicyRegistry, O as PolicyOutcome, P as evaluatePolicyDefinition, R as validatePolicyGuidance, S as PolicyGuidanceValidationResult, T as PolicyKind, V as ReconciliationRequiredError, _ as PolicyEvaluator, a as DataPolicyLiteral, b as PolicyFallbackTrigger, c as DataPolicyValidationResult, d as PolicyCorrectiveAction, f as PolicyCorrectiveActionBase, g as PolicyEvaluationResult, h as PolicyEvaluationMode, i as DataPolicyDefinition, j as aggregatePolicyOutcomes, k as PolicyRegistry, l as PolicyAuthorityReference, m as PolicyDispatchEvidence, n as DataPolicyCondition, o as DataPolicySource, p as PolicyCorrectiveActionKind, r as DataPolicyConditionResult, s as DataPolicySourceReference, t as DataPolicyComparisonOperator, u as PolicyContext, v as PolicyFact, w as PolicyInvokeActionCorrectiveAction, x as PolicyGuidance, y as PolicyFallbackDefinition, z as RetryableExecutionError } from "./index-sPUPs8pr.js";
+import { A as RuntimePolicyDefinition, B as isRetryableExecutionError, C as PolicyId, D as PolicyNavigateCorrectiveAction, E as PolicyManualCorrectiveAction, F as evaluatePolicyDefinitions, H as isReconciliationRequiredError, I as evaluateRegisteredPolicies, L as validateDataPolicyDefinition, M as assertPolicyId, N as createPolicyRegistry, O as PolicyOutcome, P as evaluatePolicyDefinition, R as validatePolicyGuidance, S as PolicyGuidanceValidationResult, T as PolicyKind, U as RetryableHandlerError, V as ReconciliationRequiredError, W as isRetryableHandlerError, _ as PolicyEvaluator, a as DataPolicyLiteral, b as PolicyFallbackTrigger, c as DataPolicyValidationResult, d as PolicyCorrectiveAction, f as PolicyCorrectiveActionBase, g as PolicyEvaluationResult, h as PolicyEvaluationMode, i as DataPolicyDefinition, j as aggregatePolicyOutcomes, k as PolicyRegistry, l as PolicyAuthorityReference, m as PolicyDispatchEvidence, n as DataPolicyCondition, o as DataPolicySource, p as PolicyCorrectiveActionKind, r as DataPolicyConditionResult, s as DataPolicySourceReference, t as DataPolicyComparisonOperator, u as PolicyContext, v as PolicyFact, w as PolicyInvokeActionCorrectiveAction, x as PolicyGuidance, y as PolicyFallbackDefinition, z as RetryableExecutionError } from "./index-DCaegG3v.js";
 import { a as StateMachineRegistry, c as evaluateStateMachineTransition, i as StateMachineDefinition, l as validateStateMachineTransition, n as StateDefinition, o as TransitionContext, r as StateMachineDatabaseClient, s as createStateMachineRegistry, t as StateClass } from "./index-fmUiRBXu.js";
 import { a as ReplayViewOptions, c as ReplayableAssetEvent, d as ViewRegistry, f as ViewUsageMetadata, g as viewContractKey, h as replayView, i as ReplaySnapshot, l as ViewContract, m as replayEvents, n as ReplayEventsResult, o as ReplayWarning, p as createViewRegistry, r as ReplayScope, s as ReplayWarningCode, t as ReplayEventsOptions, u as ViewEventConsumption } from "./index-IqcDvl69.js";
 import { CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DeclarativeInvariant, EventTypeRegistration, EventTypeRegistrationInput, FabricModule, IdPrefixRegistration, InvariantEnforcement, ModuleDependency, ModuleDependencyInput, ModuleRegistry, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, PolicyRegistration, StateMachineRegistration, createModuleRegistry, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, registerFabricModule, registerFabricModules, validateAndOrderFabricModules, validateModuleNamespace } from "./modules/index.js";
@@ -15,4 +15,4 @@ import { C as AnonymizationPolicy, D as stableChecksum, E as FieldRedactor, S as
 import { ExecutionAttestation, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, GovernanceRuntimeEvidence, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, PolicyObligation, PolicyObligationStatus, ReconciliationStatus, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext } from "./governance/index.js";
 import { FABRIC_ID_PREFIXES, FabricIdPrefix, createFabricId, isFabricId, parseFabricId } from "./ids/index.js";
 import { FakeActionContextOptions, createDeterministicIdFactory, createFakeActionContext, createInMemoryAdapterRegistry } from "./testing/index.js";
-export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionLease, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };
+export { ACTOR_TYPES, ANONYMIZATION_POLICY_VERSION, AcceptedExternalOperation, ActionAdmission, ActionAdmissionDecision, ActionAdmissionInput, ActionAdmissionSignal, ActionCompletionMode, ActionConnectivity, ActionConsistency, ActionContext, ActionDataSensitivity, ActionDefinition, ActionExecutionContract, ActionFinalizationContext, ActionFinalizationEvent, ActionFinalizationInput, ActionFinalizationResult, ActionFinalizationStep, ActionFinalizer, ActionHandler, ActionId, ActionIdempotencyStance, ActionRegistry, ActionResult, ActionStateMachineBinding, ActionStatus, ActorType, AdapterAttempt, AdapterCircuitAdmission, AdapterCircuitBreaker, AdapterCircuitBreakerConfig, AdapterCircuitBreakerEvent, AdapterCircuitBreakerEventListener, AdapterCircuitBreakerEventReason, AdapterCircuitBreakerManualOverride, AdapterCircuitBreakerProvider, AdapterCircuitBreakerRegistry, AdapterCircuitBreakerRegistryOptions, AdapterCircuitBreakerScope, AdapterCircuitOpenError, AdapterCircuitOutcome, AdapterCircuitState, AdapterExecutionContext, AdapterExecutionLease, AdapterExecutionResult, AdapterExecutor, AdapterImplementation, AdapterOutcomeEvidence, AdapterOutcomeKind, AdapterRegistry, AdapterRetryPolicy, AdapterStep, AdapterStepRetryPolicy, AgentActionPolicyContext, AgentActionPolicyDecision, AgentActionPolicyDefinition, AgentActionPolicyEvaluator, AgentActionPolicyRegistry, AgentActionRiskTier, AgentActionRoute, AnalyticsDataContract, AnalyticsDataContractSource, AnalyticsEligibilityDecision, AnonymizationContext, AnonymizationEngine, type AnonymizationEngineOptions, AnonymizationFieldMetadata, type AnonymizationFieldPolicy, type AnonymizationLifecycleEvidence, AnonymizationMetadata, type AnonymizationPolicy, AnonymizationResult, AssetEventActorType, AssetEventEnvelope, type AssetEventLike, AssetEventSubjectType, AssetEventType, AuthorityMoment, CapabilityMetadata, CapabilityPortRequirement, CapabilityRequirements, CapabilityWorkflowCompensation, CapabilityWorkflowDeclaration, CapabilityWorkflowTimer, DEFAULT_EVIDENCE_PACKET_TYPE, DEFAULT_EVIDENCE_REDACTION_REASON, DataClassificationRule, DataPolicyComparisonOperator, DataPolicyCondition, DataPolicyConditionResult, DataPolicyDefinition, DataPolicyLiteral, DataPolicySource, DataPolicySourceReference, DataPolicyValidationResult, DeclarativeInvariant, EVIDENCE_PACKET_CHECKSUM_ALGORITHM, EVIDENCE_PACKET_SCHEMA_VERSION, EventContractRegistry, EventProvenance, EventTypeRegistration, EventTypeRegistrationInput, type EvidenceEventQuery, type EvidenceEventRecord, EvidenceGenerationContext, type EvidenceInvocationRecord, type EvidenceJsonRecord, EvidencePacketEnvelope, EvidencePacketGenerationError, type EvidencePacketGenerationErrorCode, type EvidencePacketLike, type EvidencePacketPayload, type EvidencePacketReadPort, EvidencePacketReference, type EvidencePacketRendererInput, type EvidencePacketRendererOptions, EvidencePacketStatus, EvidencePacketSubject, type EvidenceRecord, EvidenceRenderer, type EvidenceScope, type EvidenceTimestamp, ExecuteWithRetryOptions, ExecutionAttestation, ExecutionContractFinding, ExecutionContractFindingCode, ExecutionContractProfile, ExecutionContractProfileOptions, ExecutionPrincipal, ExternalReconciliation, ExternalResourceOperation, ExternalResourceRef, FABRIC_GOVERNANCE_CONTRACT_VERSION, FABRIC_ID_PREFIXES, FabricIdPrefix, FabricModule, FabricObjectType, FabricRuntimeServices, FakeActionContextOptions, FieldRedactor, FinalizationJson, FinalizationRecord, type GenerateEvidencePacketInput, type GenerateEvidencePacketOptions, GovernanceRuntimeEvidence, IdPrefixRegistration, InMemoryAdapterCircuitBreaker, InMemoryAdapterCircuitBreakerOptions, InvariantEnforcement, JsonPrimitive, JsonSchemaExportableValidator, JsonSchemaValidationIssue, JsonValue, MODULE_MANIFEST_VERSION, MissingAdapterRegistrationError, ModuleDependency, ModuleDependencyInput, ModuleManifest, ModuleManifestAction, ModuleManifestActionStateMachine, ModuleManifestActionV1, ModuleManifestAdapterStep, ModuleManifestBundle, ModuleManifestBundleV1, ModuleManifestCodePolicy, ModuleManifestDataPolicy, ModuleManifestEventType, ModuleManifestIdPrefix, ModuleManifestObjectType, ModuleManifestObjectTypeV1, ModuleManifestPolicy, ModuleManifestStateMachine, ModuleManifestStateMachineTransition, ModuleManifestV1, ModuleManifestView, ModuleRegistry, MutationFootprint, MutationFootprintEntry, MutationGovernanceContext, MutationGovernanceResolutionInput, MutationGovernanceResolver, ObjectRelationCardinality, ObjectRelationDefinition, ObjectRelationDeleteBehavior, ObjectRelationSemantics, ObjectTypeRegistration, ObjectTypeRegistrationInput, ObjectTypeRegistry, PLATFORM_PRIVACY_POLICY_VERSION, PlatformDataClass, PolicyAuthorityReference, PolicyContext, PolicyCorrectiveAction, PolicyCorrectiveActionBase, PolicyCorrectiveActionKind, PolicyDispatchEvidence, PolicyEvaluationMode, PolicyEvaluationResult, PolicyEvaluator, PolicyFact, PolicyFallbackDefinition, PolicyFallbackTrigger, PolicyGuidance, PolicyGuidanceValidationResult, PolicyId, PolicyInvokeActionCorrectiveAction, PolicyKind, PolicyManualCorrectiveAction, PolicyNavigateCorrectiveAction, PolicyObligation, PolicyObligationStatus, PolicyOutcome, PolicyRegistration, PolicyRegistry, PortableJsonSchema, ReconciliationRequiredError, ReconciliationStatus, RedactionMethod, RedactionRule, ReplayEventsOptions, ReplayEventsResult, ReplayScope, ReplaySnapshot, ReplayViewOptions, ReplayWarning, ReplayWarningCode, ReplayableAssetEvent, ResolvedAdapterRetryPolicy, RetentionRule, RetryableExecutionError, RetryableHandlerError, RuntimePolicyDefinition, STRICT_EXECUTION_CONTRACT_PROFILE, STRICT_EXECUTION_CONTRACT_PROFILE_ID, SagaChildActionInput, SagaCompletion, SagaCompletionEvent, SagaContext, SagaImplementation, SagaRunChild, SchemaParseIssue, SchemaParseResult, SchemaValidator, StagedInvocationRequest, StateClass, StateDefinition, StateMachineDatabaseClient, StateMachineDefinition, StateMachineRegistration, StateMachineRegistry, SurfaceDeclaration, TransitionContext, ViewContract, ViewEventConsumption, ViewRegistry, ViewUsageMetadata, aggregatePolicyOutcomes, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, assertActionFinalization, assertActionId, assertActorType, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, assertAdapterStepDeadlines, assertGovernanceRuntimeEvidence, assertMutationGovernanceContext, assertObjectType, assertPolicyId, assertPortableJsonSchema, assertSurfaceDeclaration, buildAnonymizationLifecycleEvidence, canonicalJson, classifyAdapterOutcome, classifyCircuitBreakerOutcome, computeEvidencePacketChecksum, createActionRegistry, createDeterministicIdFactory, createEventContractRegistry, createEvidencePacketRenderer, createFabricId, createFakeActionContext, createInMemoryAdapterRegistry, createModuleRegistry, createObjectTypeRegistry, createPolicyRegistry, createStateMachineRegistry, createViewRegistry, defineFinalizingAction, evaluatePolicyDefinition, evaluatePolicyDefinitions, evaluateRegisteredPolicies, evaluateStateMachineTransition, executeWithAdapterRetry, executionContractProfile, exportModuleManifest, exportModuleManifestBundle, generateEvidencePacket, getEventTypeName, getModuleDependencyNamespace, getObjectTypeName, getRetryDelayMs, isActorType, isAdapterCircuitOpenError, isFabricId, isJsonSchemaExportableValidator, isReconciliationRequiredError, isRetryableExecutionError, isRetryableHandlerError, normalizeModuleManifest, normalizeModuleManifestBundle, parseFabricId, registerFabricModule, registerFabricModules, replayEvents, replayView, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome, stableChecksum, validateAndOrderFabricModules, validateDataPolicyDefinition, validateModuleNamespace, validatePolicyGuidance, validatePortableJson, validateStateMachineTransition, verifyEvidencePacketChecksum, viewContractKey };