@fabricorg/platform 1.7.0 → 1.8.0

package/dist/chunk-IF6NJORI.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../adapters/circuit-breaker.ts","../adapters/index.ts"],"names":[],"mappings":";;;AAgDO,SAAS,8BAA8B,IAAA,EAAiD;AAC9F,EAAA,QAAQ,IAAA;AAAM,IACb,KAAK,SAAA;AACJ,MAAA,OAAO,SAAA;AAAA,IACR,KAAK,mBAAA;AACJ,MAAA,OAAO,SAAA;AAAA,IACR,KAAK,mBAAA;AAAA,IACL,KAAK,SAAA;AAAA,IACL,KAAK,WAAA;AACJ,MAAA,OAAO,SAAA;AAAA,IACR;AAEC,MAAA,OAAO,SAAA;AAAA;AAEV;AA0HA,IAAM,gBAAA,GAAmE,CAAC,YAAA,EAAc,cAAc,CAAA;AAS/F,SAAS,kCAAkC,MAAA,EAA2C;AAC5F,EAAA,IAAI,CAAC,MAAA,IAAU,OAAO,MAAA,KAAW,QAAA,EAAU;AAC1C,IAAA,MAAM,IAAI,WAAW,mDAAmD,CAAA;AAAA,EACzE;AACA,EAAA,IAAI,MAAA,CAAO,IAAA,KAAS,SAAA,IAAa,MAAA,CAAO,SAAS,SAAA,EAAW;AAC3D,IAAA,MAAM,IAAI,WAAW,CAAA,iEAAA,EAAoE,IAAA,CAAK,UAAU,MAAA,CAAO,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACxH;AACA,EAAA,IAAI,CAAC,OAAO,SAAA,CAAU,MAAA,CAAO,gBAAgB,CAAA,IAAK,MAAA,CAAO,mBAAmB,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,yEAAA,EAA4E,OAAO,MAAA,CAAO,gBAAgB,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACpI;AACA,EAAA,IAAI,OAAO,MAAA,CAAO,QAAA,KAAa,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,QAAQ,CAAA,IAAK,MAAA,CAAO,QAAA,IAAY,CAAA,EAAG;AACrG,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,gFAAA,EAAmF,OAAO,MAAA,CAAO,QAAQ,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACnI;AACA,EAAA,IAAI,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,IAAY,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,IAAK,MAAA,CAAO,UAAA,GAAa,CAAA,EAAG;AAC1G,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,sFAAA,EAAyF,OAAO,MAAA,CAAO,UAAU,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EAC3I;AACA,EAAA,IACC,MAAA,CAAO,cAAA,KAAmB,MAAA,KACzB,CAAC,MAAA,CAAO,SAAA,CAAU,MAAA,CAAO,cAAc,CAAA,IAAK,MAAA,CAAO,cAAA,GAAiB,CAAA,CAAA,EACpE;AACD,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,uEAAA,EAA0E,OAAO,MAAA,CAAO,cAAc,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EAChI;AACA,EAAA,IACC,MAAA,CAAO,YAAA,KAAiB,MAAA,KACvB,OAAO,OAAO,YAAA,KAAiB,QAAA,IAAY,CAAC,MAAA,CAAO,SAAS,MAAA,CAAO,YAAY,CAAA,IAAK,MAAA,CAAO,gBAAgB,CAAA,CAAA,EAC3G;AACD,IAAA,MAAM,IAAI,UAAA,CAAW,CAAA,oFAAA,EAAuF,OAAO,MAAA,CAAO,YAAY,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EAC3I;AACA,EAAA,IAAI,MAAA,CAAO,mBAAmB,MAAA,IAAa,CAAC,iBAAiB,QAAA,CAAS,MAAA,CAAO,cAAc,CAAA,EAAG;AAC7F,IAAA,MAAM,IAAI,WAAW,CAAA,mFAAA,EAAsF,IAAA,CAAK,UAAU,MAAA,CAAO,cAAc,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACpJ;AACD;AAsEO,IAAM,gCAAN,MAAqE;AAAA,EAClE,GAAA;AAAA,EACA,IAAA;AAAA,EACQ,MAAA;AAAA,EACA,GAAA;AAAA,EACA,OAAA;AAAA,EACA,YAAA;AAAA,EACT,UAAoB,EAAC;AAAA,EACrB,KAAA,GAA6B,QAAA;AAAA,EAC7B,QAAA,GAAW,CAAA;AAAA,EACX,aAAA;AAAA;AAAA,EAEA,UAAA,GAAa,CAAA;AAAA,EACb,cAAA;AAAA;AAAA,EAES,SAAuC,EAAC;AAAA,EACjD,cAAA,GAAiB,CAAA;AAAA,EACjB,QAAA,GAAW,KAAA;AAAA,EAEnB,YAAY,OAAA,EAA+C;AAC1D,IAAA,iCAAA,CAAkC,QAAQ,MAAM,CAAA;AAChD,IAAA,IAAA,CAAK,MAAM,OAAA,CAAQ,GAAA;AACnB,IAAA,IAAA,CAAK,MAAA,GAAS,EAAE,GAAG,OAAA,CAAQ,MAAA,EAAO;AAClC,IAAA,IAAA,CAAK,IAAA,GAAO,QAAQ,MAAA,CAAO,IAAA;AAC3B,IAAA,IAAA,CAAK,GAAA,GAAM,OAAA,CAAQ,GAAA,IAAO,IAAA,CAAK,GAAA;AAC/B,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,cAAA,GAAiB,QAAQ,MAAA,CAAO,cAAA;AACrC,IAAA,IAAA,CAAK,YAAA,GAAe,OAAA,CAAQ,MAAA,CAAO,YAAA,IAAgB,IAAA,CAAK,GAAA,CAAI,OAAA,CAAQ,MAAA,CAAO,UAAA,EAAY,OAAA,CAAQ,MAAA,CAAO,QAAQ,CAAA;AAAA,EAC/G;AAAA,EAEA,QAAA,GAAgC;AAC/B,IAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,CAAA;AACtB,IAAA,OAAO,KAAK,aAAA,EAAc;AAAA,EAC3B;AAAA,EAEA,iBAAA,GAAqE;AACpE,IAAA,OAAO,IAAA,CAAK,cAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB,QAAA,EAAiE;AAClF,IAAA,IAAI,aAAa,MAAA,IAAa,CAAC,gBAAA,CAAiB,QAAA,CAAS,QAAQ,CAAA,EAAG;AACnE,MAAA,MAAM,IAAI,UAAA,CAAW,CAAA,mFAAA,EAAsF,KAAK,SAAA,CAAU,QAAQ,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,IACvI;AACA,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AAEf,IAAA,IAAI,QAAA,KAAa,KAAK,cAAA,EAAgB;AACtC,IAAA,IAAA,CAAK,UAAU,MAAM;AACpB,MAAA,MAAM,IAAA,GAAO,KAAK,aAAA,EAAc;AAChC,MAAA,IAAA,CAAK,cAAA,GAAiB,QAAA;AACtB,MAAA,IAAA,CAAK,UAAA,EAAA;AACL,MAAA,IAAI,aAAa,MAAA,EAAW;AAC3B,QAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AACb,QAAA,IAAA,CAAK,YAAA,EAAa;AAAA,MACnB;AACA,MAAA,IAAA,CAAK,IAAA,CAAK;AAAA,QACT,IAAA,EAAM,cAAA;AAAA,QACN,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,EAAA,EAAI,GAAA;AAAA,QACJ,IAAA;AAAA,QACA,EAAA,EAAI,KAAK,aAAA,EAAc;AAAA,QACvB,MAAA,EAAQ,QAAA,KAAa,MAAA,GAAY,yBAAA,GAA4B,iBAAA;AAAA,QAC7D,GAAI,QAAA,GAAW,EAAE,cAAA,EAAgB,QAAA,KAAa;AAAC,OAC/C,CAAA;AAAA,IACF,CAAC,CAAA;AAAA,EACF;AAAA,EAEA,KAAA,GAAiC;AAChC,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,KAAA,EAAO,IAAA,CAAK,KAAK,CAAA;AAAA,EACrC;AAAA,EAEA,OAAA,GAAmC;AAClC,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,OAAO,KAAK,SAAA,CAAU,MAAM,KAAK,MAAA,CAAO,IAAA,EAAM,GAAG,CAAC,CAAA;AAAA,EACnD;AAAA,EAEA,MAAA,CAAO,SAAgC,SAAA,EAA2C;AACjF,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AAGrB,IAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,IAAA,IAAA,CAAK,UAAU,MAAM,IAAA,CAAK,aAAa,OAAA,EAAS,SAAA,EAAW,GAAG,CAAC,CAAA;AAAA,EAChE;AAAA,EAEQ,YAAA,CAAa,OAAA,EAAgC,SAAA,EAAgD,GAAA,EAAmB;AACvH,IAAA,MAAM,aAAa,SAAA,EAAW,UAAA;AAE9B,IAAA,IAAI,UAAA,KAAe,MAAA,IAAa,UAAA,KAAe,IAAA,CAAK,UAAA,EAAY;AAEhE,IAAA,MAAM,aAAA,GACL,IAAA,CAAK,KAAA,KAAU,WAAA,IACf,IAAA,CAAK,kBAAkB,MAAA,KACtB,UAAA,KAAe,MAAA,IAAa,SAAA,EAAW,KAAA,KAAU,IAAA,CAAA;AACnD,IAAA,IAAI,YAAY,SAAA,EAAW;AAE1B,MAAA,IAAI,aAAA,OAAoB,YAAA,EAAa;AACrC,MAAA;AAAA,IACD;AACA,IAAA,IAAA,CAAK,MAAM,GAAG,CAAA;AACd,IAAA,IAAA,CAAK,OAAA,CAAQ,KAAK,EAAE,EAAA,EAAI,KAAK,OAAA,EAAS,OAAA,KAAY,WAAW,CAAA;AAC7D,IAAA,IAAI,KAAK,cAAA,EAAgB;AACzB,IAAA,IAAI,aAAA,EAAe;AAClB,MAAA,IAAA,CAAK,YAAA,EAAa;AAClB,MAAA,IAAI,YAAY,SAAA,EAAW;AAC1B,QAAA,IAAA,CAAK,UAAU,EAAC;AAChB,QAAA,IAAA,CAAK,UAAA,CAAW,QAAA,EAAU,iBAAA,EAAmB,GAAG,CAAA;AAAA,MACjD,CAAA,MAAO;AACN,QAAA,IAAA,CAAK,QAAA,GAAW,GAAA;AAChB,QAAA,IAAA,CAAK,UAAA,CAAW,MAAA,EAAQ,cAAA,EAAgB,GAAG,CAAA;AAAA,MAC5C;AACA,MAAA;AAAA,IACD;AACA,IAAA,IAAI,KAAK,KAAA,KAAU,QAAA,IAAY,YAAY,SAAA,IAAa,IAAA,CAAK,YAAW,EAAG;AAC1E,MAAA,IAAA,CAAK,QAAA,GAAW,GAAA;AAChB,MAAA,IAAA,CAAK,UAAA,CAAW,MAAA,EAAQ,mBAAA,EAAqB,GAAG,CAAA;AAAA,IACjD;AAAA,EACD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,MAAA,CAAO,MAAe,GAAA,EAAsC;AACnE,IAAA,IAAI,IAAA,CAAK,mBAAmB,cAAA,EAAgB;AAC3C,MAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,cAAA,EAAgB,cAAA,EAAgB,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AAAA,IACpH;AACA,IAAA,IAAI,IAAA,CAAK,mBAAmB,YAAA,EAAc;AACzC,MAAA,OAAO,IAAA,CAAK,OAAO,IAAA,EAAM,EAAE,OAAO,MAAA,EAAQ,cAAA,EAAgB,cAAc,CAAA;AAAA,IACzE;AAGA,IAAA,MAAM,eAAA,GAAkB,KAAK,KAAA,KAAU,MAAA,IAAU,MAAM,IAAA,CAAK,QAAA,IAAY,KAAK,MAAA,CAAO,UAAA;AAIpF,IAAA,IAAI,IAAA,EAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC1B,IAAA,MAAM,KAAA,GAA6B,CAAC,IAAA,IAAQ,eAAA,GAAkB,cAAc,IAAA,CAAK,KAAA;AACjF,IAAA,IAAI,KAAA,KAAU,QAAA,EAAU,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,KAAA,EAAO,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AAC3G,IAAA,IAAI,UAAU,MAAA,EAAQ;AACrB,MAAA,OAAO,IAAA,CAAK,OAAO,IAAA,EAAM;AAAA,QACxB,KAAA,EAAO,MAAA;AAAA,QACP,YAAA,EAAc,KAAK,GAAA,CAAI,CAAA,EAAG,KAAK,QAAA,GAAW,IAAA,CAAK,MAAA,CAAO,UAAA,GAAa,GAAG;AAAA,OACtE,CAAA;AAAA,IACF;AAEA,IAAA,MAAM,SAAA,GACJ,CAAC,IAAA,IAAQ,eAAA,IACV,IAAA,CAAK,kBAAkB,MAAA,IACvB,GAAA,GAAM,IAAA,CAAK,aAAA,IAAiB,IAAA,CAAK,YAAA;AAClC,IAAA,IAAI,CAAC,WAAW,OAAO,IAAA,CAAK,OAAO,IAAA,EAAM,EAAE,KAAA,EAAO,WAAA,EAAa,CAAA;AAC/D,IAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAO,WAAA,EAAa,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AAEhG,IAAA,IAAA,CAAK,aAAA,GAAgB,GAAA;AACrB,IAAA,IAAA,CAAK,UAAA,EAAA;AACL,IAAA,OAAO,EAAE,SAAS,IAAA,EAAM,KAAA,EAAO,aAAa,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,IAAA,CAAK,UAAA,EAAW;AAAA,EACtF;AAAA,EAEQ,MAAA,CACP,MACA,MAAA,EAC0B;AAC1B,IAAA,MAAM,OAAA,GAAU,KAAK,IAAA,KAAS,SAAA;AAC9B,IAAA,IAAI,IAAA,EAAM;AACT,MAAA,IAAA,CAAK,IAAA,CAAK;AAAA,QACT,IAAA,EAAM,UAAU,UAAA,GAAa,cAAA;AAAA,QAC7B,KAAK,IAAA,CAAK,GAAA;AAAA,QACV,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,EAAA,EAAI,KAAK,GAAA,EAAI;AAAA,QACb,GAAG;AAAA,OACH,CAAA;AAAA,IACF;AACA,IAAA,MAAM,aAAa,IAAA,CAAK,UAAA;AACxB,IAAA,OAAO,UACJ,EAAE,OAAA,EAAS,OAAO,KAAA,EAAO,KAAA,EAAO,GAAG,MAAA,EAAQ,UAAA,KAC3C,EAAE,OAAA,EAAS,MAAM,KAAA,EAAO,KAAA,EAAO,aAAa,IAAA,EAAM,GAAG,QAAQ,UAAA,EAAW;AAAA,EAC5E;AAAA,EAEQ,YAAA,GAAqB;AAC5B,IAAA,IAAA,CAAK,aAAA,GAAgB,MAAA;AAAA,EACtB;AAAA;AAAA,EAGQ,QAAQ,GAAA,EAAmB;AAClC,IAAA,IAAI,IAAA,CAAK,UAAU,MAAA,IAAU,GAAA,GAAM,KAAK,QAAA,IAAY,IAAA,CAAK,OAAO,UAAA,EAAY;AAC3E,MAAA,IAAA,CAAK,YAAA,EAAa;AAClB,MAAA,IAAA,CAAK,UAAA,CAAW,WAAA,EAAa,kBAAA,EAAoB,GAAG,CAAA;AAAA,IACrD;AAAA,EACD;AAAA,EAEQ,UAAA,GAAsB;AAC7B,IAAA,MAAM,cAAA,GAAiB,IAAA,CAAK,MAAA,CAAO,cAAA,IAAkB,KAAK,MAAA,CAAO,gBAAA;AACjE,IAAA,MAAM,KAAA,GAAQ,KAAK,OAAA,CAAQ,MAAA;AAC3B,IAAA,IAAI,KAAA,GAAQ,gBAAgB,OAAO,KAAA;AACnC,IAAA,IAAI,WAAA,GAAc,CAAA;AAClB,IAAA,KAAA,IAAS,KAAA,GAAQ,KAAA,GAAQ,CAAA,EAAG,KAAA,IAAS,CAAA,IAAK,KAAK,OAAA,CAAQ,KAAK,CAAA,CAAG,OAAA,EAAS,KAAA,EAAA,EAAS,WAAA,EAAA;AACjF,IAAA,IAAI,WAAA,IAAe,IAAA,CAAK,MAAA,CAAO,gBAAA,EAAkB,OAAO,IAAA;AACxD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,CAAC,KAAA,EAAO,MAAA,KAAW,KAAA,IAAS,MAAA,CAAO,OAAA,GAAU,CAAA,GAAI,CAAA,CAAA,EAAI,CAAC,CAAA;AAC3F,IAAA,OAAO,QAAA,GAAW,KAAA,IAAS,IAAA,CAAK,MAAA,CAAO,gBAAA,GAAmB,cAAA;AAAA,EAC3D;AAAA,EAEQ,MAAM,GAAA,EAAmB;AAChC,IAAA,MAAM,MAAA,GAAS,GAAA,GAAM,IAAA,CAAK,MAAA,CAAO,QAAA;AACjC,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,OAAO,IAAA,GAAO,KAAK,OAAA,CAAQ,MAAA,IAAU,KAAK,OAAA,CAAQ,IAAI,CAAA,CAAG,EAAA,GAAK,MAAA,EAAQ,IAAA,EAAA;AACtE,IAAA,IAAI,OAAO,CAAA,EAAG,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,GAAG,IAAI,CAAA;AAAA,EAC1C;AAAA,EAEQ,UAAA,CAAW,EAAA,EAAyB,MAAA,EAA0C,EAAA,EAAkB;AACvG,IAAA,MAAM,OAAO,IAAA,CAAK,KAAA;AAClB,IAAA,IAAI,SAAS,EAAA,EAAI;AACjB,IAAA,IAAA,CAAK,KAAA,GAAQ,EAAA;AACb,IAAA,IAAA,CAAK,UAAA,EAAA;AACL,IAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAM,cAAA,EAAgB,KAAK,IAAA,CAAK,GAAA,EAAK,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,EAAA,EAAI,IAAA,EAAM,EAAA,EAAI,QAAQ,CAAA;AAAA,EACzF;AAAA,EAEQ,aAAA,GAAqC;AAC5C,IAAA,IAAI,KAAK,cAAA,EAAgB,OAAO,IAAA,CAAK,cAAA,KAAmB,eAAe,MAAA,GAAS,QAAA;AAChF,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,OAAO,GAAA,EAAmB;AACjC,IAAA,IAAI,KAAK,cAAA,EAAgB;AACzB,IAAA,IAAA,CAAK,SAAA,CAAU,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAAA,EACvC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,UAAa,IAAA,EAAkB;AACtC,IAAA,IAAA,CAAK,cAAA,EAAA;AACL,IAAA,IAAI;AACH,MAAA,OAAO,IAAA,EAAK;AAAA,IACb,CAAA,SAAE;AACD,MAAA,IAAA,CAAK,cAAA,EAAA;AACL,MAAA,IAAI,IAAA,CAAK,cAAA,KAAmB,CAAA,EAAG,IAAA,CAAK,KAAA,EAAM;AAAA,IAC3C;AAAA,EACD;AAAA,EAEQ,KAAK,KAAA,EAAyC;AACrD,IAAA,IAAI,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,MAAA,CAAO,KAAK,KAAK,CAAA;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,KAAA,GAAc;AACrB,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI;AACH,MAAA,KAAA,IAAS,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAM,EAAG,KAAA,EAAO,KAAA,GAAQ,IAAA,CAAK,MAAA,CAAO,KAAA,EAAM,EAAG,IAAA,CAAK,QAAQ,KAAK,CAAA;AAAA,IAC7F,CAAA,SAAE;AACD,MAAA,IAAA,CAAK,QAAA,GAAW,KAAA;AAAA,IACjB;AAAA,EACD;AAAA,EAEQ,QAAQ,KAAA,EAAyC;AACxD,IAAA,MAAM,WAAW,IAAA,CAAK,OAAA;AACtB,IAAA,IAAI,CAAC,QAAA,EAAU;AACf,IAAA,IAAI;AACH,MAAA,MAAM,MAAA,GAAS,SAAS,KAAK,CAAA;AAC7B,MAAA,IAAI,MAAA,IAAU,OAAQ,MAAA,CAA6B,IAAA,KAAS,UAAA,EAAY;AACvE,QAAC,MAAA,CAA6B,IAAA,CAAK,KAAA,CAAA,EAAW,MAAM,KAAA,CAAS,CAAA;AAAA,MAC9D;AAAA,IACD,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACD;AACD;AAmBO,IAAM,gCAAN,MAA6E;AAAA,EAGnF,WAAA,CAA6B,OAAA,GAAgD,EAAC,EAAG;AAApD,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAAA,EAAqD;AAAA,EAArD,OAAA;AAAA,EAFZ,QAAA,uBAAe,GAAA,EAA2C;AAAA,EAI3E,WAAW,OAAA,EAA2E;AACrF,IAAA,IAAI,CAAC,OAAA,CAAQ,cAAA,EAAgB,OAAO,MAAA;AACpC,IAAA,MAAM,MAAM,CAAA,EAAG,OAAA,CAAQ,WAAW,CAAA,CAAA,EAAI,QAAQ,SAAS,CAAA,CAAA;AACvD,IAAA,IAAI,OAAA,GAAU,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA;AACnC,IAAA,IAAI,CAAC,OAAA,EAAS;AACb,MAAA,OAAA,GAAU,IAAI,6BAAA,CAA8B;AAAA,QAC3C,GAAA;AAAA,QACA,QAAQ,OAAA,CAAQ,cAAA;AAAA,QAChB,GAAI,IAAA,CAAK,OAAA,CAAQ,GAAA,GAAM,EAAE,KAAK,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAI,GAAI,EAAC;AAAA,QACpD,GAAI,IAAA,CAAK,OAAA,CAAQ,OAAA,GAAU,EAAE,SAAS,IAAA,CAAK,OAAA,CAAQ,OAAA,EAAQ,GAAI;AAAC,OAChE,CAAA;AACD,MAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,OAAA;AAAA,EACR;AAAA;AAAA,EAGA,GAAA,CAAI,aAAqB,SAAA,EAA8D;AACtF,IAAA,OAAO,KAAK,QAAA,CAAS,GAAA,CAAI,GAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAE,CAAA;AAAA,EACvD;AACD;AAOO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EAChC,IAAA,GAAO,yBAAA;AAAA,EAChB,IAAA,GAAO,sBAAA;AAAA,EACP,MAAA,GAAS,cAAA;AAAA,EACT,UAAA;AAAA,EACA,KAAA;AAAA;AAAA,EAEA,OAAA;AAAA,EACA,YAAA;AAAA,EACA,cAAA;AAAA;AAAA,EAEA,SAAA;AAAA,EAET,YAAY,KAAA,EAOT;AACF,IAAA,MAAM,QAAQ,KAAA,CAAM,YAAA,KAAiB,SAAY,CAAA,cAAA,EAAiB,KAAA,CAAM,YAAY,CAAA,GAAA,CAAA,GAAQ,EAAA;AAC5F,IAAA,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAA,CAAM,KAAA,KAAU,WAAA,GAAc,oCAAA,GAAuC,MAAM,CAAA,KAAA,EAAQ,KAAA,CAAM,UAAU,CAAA,4BAAA,EAA+B,KAAK,CAAA,CAAA,CAAG,CAAA;AACtK,IAAA,IAAA,CAAK,aAAa,KAAA,CAAM,UAAA;AACxB,IAAA,IAAA,CAAK,QAAQ,KAAA,CAAM,KAAA;AACnB,IAAA,IAAA,CAAK,UAAU,KAAA,CAAM,OAAA;AACrB,IAAA,IAAI,KAAA,CAAM,YAAA,KAAiB,MAAA,EAAW,IAAA,CAAK,eAAe,KAAA,CAAM,YAAA;AAChE,IAAA,IAAI,KAAA,CAAM,cAAA,KAAmB,MAAA,EAAW,IAAA,CAAK,iBAAiB,KAAA,CAAM,cAAA;AACpE,IAAA,IAAI,KAAA,CAAM,SAAA,KAAc,MAAA,EAAW,IAAA,CAAK,YAAY,KAAA,CAAM,SAAA;AAAA,EAC3D;AACD;AAOO,SAAS,0BAA0B,KAAA,EAAkD;AAC3F,EAAA,IAAI,KAAA,YAAiB,yBAAyB,OAAO,IAAA;AACrD,EAAA,OACC,OAAO,UAAU,QAAA,IACjB,KAAA,KAAU,QACT,KAAA,CAA6B,IAAA,KAAS,yBAAA,IACtC,KAAA,CAA6B,IAAA,KAAS,sBAAA;AAEzC;;;AC5bA,SAAS,UAAA,CAAW,aAAqB,SAAA,EAA2B;AACnE,EAAA,OAAO,CAAA,EAAG,WAAW,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AACnC;AAEO,IAAM,+BAAA,GAAN,cAA8C,KAAA,CAAM;AAAA,EAC1D,WAAA,CAAY,aAAqB,SAAA,EAAmB;AACnD,IAAA,KAAA,CAAM,CAAA,uCAAA,EAA0C,WAAW,CAAA,iBAAA,EAAoB,SAAS,CAAA,CAAA,CAAG,CAAA;AAC3F,IAAA,IAAA,CAAK,IAAA,GAAO,iCAAA;AAAA,EACb;AACD;AAEO,IAAM,kBAAN,MAAsB;AAAA,EACX,QAAA,uBAAe,GAAA,EAAmC;AAAA,EAEnE,SAAS,OAAA,EAAsC;AAC9C,IAAA,MAAM,GAAA,GAAM,UAAA,CAAW,OAAA,CAAQ,WAAA,EAAa,QAAQ,SAAS,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,GAAG,CAAA,EAAG;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACT,CAAA,4CAAA,EAA+C,OAAA,CAAQ,WAAW,CAAA,iBAAA,EAAoB,QAAQ,SAAS,CAAA,CAAA;AAAA,OACxG;AAAA,IACD;AAEA,IAAA,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,GAAA,EAAK,OAAO,CAAA;AAAA,EAC/B;AAAA,EAEA,OAAA,CAAQ,aAAqB,SAAA,EAAsD;AAClF,IAAA,OAAO,KAAK,QAAA,CAAS,GAAA,CAAI,UAAA,CAAW,WAAA,EAAa,SAAS,CAAC,CAAA;AAAA,EAC5D;AAAA,EAEA,OAAA,CAAQ,aAAqB,SAAA,EAA0C;AACtE,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,OAAA,CAAQ,WAAA,EAAa,SAAS,CAAA;AACnD,IAAA,IAAI,CAAC,OAAA,EAAS;AACb,MAAA,MAAM,IAAI,+BAAA,CAAgC,WAAA,EAAa,SAAS,CAAA;AAAA,IACjE;AAEA,IAAA,OAAO,OAAA;AAAA,EACR;AACD;AAEA,IAAM,oBAAA,GAAmD;AAAA,EAExD,WAAA,EAAa,CAAA;AAAA,EACb,cAAA,EAAgB,GAAA;AAAA,EAChB,iBAAA,EAAmB,CAAA;AAAA,EACnB,UAAA,EAAY;AACb,CAAA;AAEA,IAAM,eAAA,GAA8C;AAAA,EACnD,UAAA,EAAY,KAAA;AAAA,EACZ,WAAA,EAAa,CAAA;AAAA,EACb,cAAA,EAAgB,CAAA;AAAA,EAChB,iBAAA,EAAmB,CAAA;AAAA,EACnB,UAAA,EAAY;AACb,CAAA;AAEO,SAAS,yBAAA,CACf,QACA,iBAAA,EAC6B;AAC7B,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,iBAAA;AAEzC,EAAA,IAAI,CAAC,UAAA,EAAY;AAChB,IAAA,OAAO,eAAA;AAAA,EACR;AAEA,EAAA,OAAO;AAAA,IACN,UAAA,EAAY,IAAA;AAAA,IACZ,WAAA,EAAa,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,MAAA,EAAQ,WAAA,IAAe,oBAAA,CAAqB,WAAA,EAAa,CAAC,CAAC,CAAA;AAAA,IAC7F,gBAAgB,IAAA,CAAK,GAAA,CAAI,GAAG,MAAA,EAAQ,cAAA,IAAkB,qBAAqB,cAAc,CAAA;AAAA,IACzF,mBAAmB,IAAA,CAAK,GAAA;AAAA,MACvB,CAAA;AAAA,MACA,MAAA,EAAQ,qBAAqB,oBAAA,CAAqB;AAAA,KACnD;AAAA,IACA,YAAY,IAAA,CAAK,GAAA,CAAI,GAAG,MAAA,EAAQ,UAAA,IAAc,qBAAqB,UAAU;AAAA,GAC9E;AACD;AAEO,SAAS,eAAA,CAAgB,SAAiB,MAAA,EAA4C;AAC5F,EAAA,MAAM,gBAAA,GACL,OAAO,cAAA,GAAiB,MAAA,CAAO,qBAAqB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,OAAA,GAAU,CAAC,CAAA;AAE5E,EAAA,OAAO,IAAA,CAAK,GAAA,CAAI,gBAAA,EAAkB,MAAA,CAAO,UAAU,CAAA;AACpD;AASO,SAAS,uBAAuB,MAAA,EAAoD;AAC1F,EAAA,IAAI,OAAO,OAAA,EAAS;AACnB,IAAA,+BAAA,CAAgC,MAAM,CAAA;AACtC,IAAA,OAAO,MAAA,CAAO,OAAA;AAAA,EACf;AACA,EAAA,OAAO,MAAA,CAAO,UAAU,SAAA,GAAY,mBAAA;AACrC;AAOO,SAAS,yBAAA,CACf,MACA,UAAA,EACU;AACV,EAAA,OAAO,SAAS,mBAAA,IAAuB,UAAA;AACxC;AAQO,SAAS,gCAAgC,MAAA,EAAsC;AACrF,EAAA,IAAI,OAAO,OAAA,IAAW,MAAA,CAAO,OAAA,IAAW,MAAA,CAAO,YAAY,SAAA,EAAW;AACrE,IAAA,MAAM,IAAI,KAAA;AAAA,MACT,CAAA,0DAAA,EAA6D,OAAO,OAAO,CAAA,8DAAA;AAAA,KAC5E;AAAA,EACD;AACD;AAMA,SAAS,oBAAA,CACR,OAAA,EACA,OAAA,EACA,SAAA,EACO;AACP,EAAA,IAAI,CAAC,OAAA,EAAS;AACd,EAAA,IAAI;AACH,IAAA,OAAA,CAAQ,MAAA,CAAO,SAAS,SAAS,CAAA;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AACD;AAEA,SAAS,gBAAA,CACR,OAAA,EACA,SAAA,EACA,OAAA,EACA,SAAA,EAC0B;AAC1B,EAAA,OAAO,IAAI,uBAAA,CAAwB;AAAA,IAClC,YAAY,OAAA,CAAQ,GAAA;AAAA,IACpB,OAAO,SAAA,CAAU,KAAA;AAAA,IACjB,OAAA;AAAA,IACA,GAAI,UAAU,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,EAAc,SAAA,CAAU,YAAA,EAAa,GAAI,EAAC;AAAA,IACvF,GAAI,UAAU,cAAA,KAAmB,MAAA,GAAY,EAAE,cAAA,EAAgB,SAAA,CAAU,cAAA,EAAe,GAAI,EAAC;AAAA,IAC7F,GAAI,SAAA,KAAc,MAAA,GAAY,EAAE,SAAA,KAAc;AAAC,GAC/C,CAAA;AACF;AAEA,eAAsB,wBAA2B,OAAA,EAAiD;AACjG,EAAA,MAAM,MAAA,GAAS,yBAAA,CAA0B,OAAA,CAAQ,MAAA,EAAQ,QAAQ,iBAAiB,CAAA;AAClF,EAAA,MAAM,KAAA,GACL,OAAA,CAAQ,KAAA,KAAU,CAAC,OAAA,KAAY,IAAI,OAAA,CAAQ,CAAC,OAAA,KAAY,UAAA,CAAW,OAAA,EAAS,OAAO,CAAC,CAAA,CAAA;AACrF,EAAA,MAAM,UAAU,OAAA,CAAQ,cAAA;AACxB,EAAA,IAAI,SAAA;AAEJ,EAAA,KAAA,IAAS,OAAA,GAAU,CAAA,EAAG,OAAA,IAAW,MAAA,CAAO,aAAa,OAAA,EAAA,EAAW;AAC/D,IAAA,IAAI,SAAA;AAIJ,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,IAAI,QAAA,GAAW,KAAA;AACf,IAAA,MAAM,MAAA,GAAS,CAAC,OAAA,KAAmC;AAClD,MAAA,IAAI,CAAC,YAAY,QAAA,EAAU;AAC3B,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,oBAAA,CAAqB,OAAA,EAAS,SAAS,SAAS,CAAA;AAAA,IACjD,CAAA;AACA,IAAA,IAAI,OAAA;AAMJ,IAAA,eAAe,aAAa,KAAA,EAAwE;AACnG,MAAA,SAAA,GAAY,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAIjE,MAAA,MAAM,gBAAgB,OAAA,CAAQ,mBAAA,GAC3B,OAAA,CAAQ,mBAAA,CAAoB,KAAK,CAAA,GACjC,mBAAA;AACH,MAAA,MAAA,CAAO,6BAAA,CAA8B,aAAa,CAAC,CAAA;AACnD,MAAA,IAAI,YACH,yBAAA,CAA0B,aAAA,EAAe,OAAO,UAAU,CAAA,IAAK,UAAU,MAAA,CAAO,WAAA;AACjF,MAAA,MAAM,OAAA,GAAU,SAAA,GAAY,YAAA,CAAa,OAAO,CAAA,GAAI,MAAA;AACpD,MAAA,IAAI,SAAS,SAAA,GAAY,KAAA;AACzB,MAAA,MAAM,WAAA,GAAc,SAAA,GAAY,eAAA,CAAgB,OAAA,EAAS,MAAM,CAAA,GAAI,MAAA;AACnE,MAAA,MAAM,OAAA,CAAQ,YAAY,EAAE,OAAA,EAAS,OAAO,SAAA,EAAW,SAAA,EAAW,aAAa,CAAA;AAE/E,MAAA,IAAI,SAAS,OAAO,OAAA;AACpB,MAAA,IAAI,CAAC,WAAW,OAAO,SAAA;AACvB,MAAA,MAAM,KAAA,CAAM,eAAe,CAAC,CAAA;AAC5B,MAAA,OAAO,OAAA;AAAA,IACR;AAEA,IAAA,IAAI;AACH,MAAA,IAAI,QAAQ,cAAA,EAAgB,MAAM,QAAQ,cAAA,CAAe,OAAA,EAAS,OAAO,WAAW,CAAA;AAAA,IACrF,SAAS,KAAA,EAAO;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa,KAAK,CAAA;AACzC,MAAA,IAAI,QAAA,KAAa,WAAW,MAAM,KAAA;AAClC,MAAA,IAAI,aAAa,OAAA,EAAS;AAC1B,MAAA,OAAA,GAAU,QAAA;AAAA,IACX;AACA,IAAA,IAAI,CAAC,OAAA,EAAS;AAEb,MAAA,IAAI,OAAA,EAAS;AACZ,QAAA,SAAA,GAAY,QAAQ,OAAA,EAAQ;AAC5B,QAAA,IAAI,CAAC,UAAU,OAAA,EAAS,MAAM,iBAAiB,OAAA,EAAS,SAAA,EAAW,SAAS,SAAS,CAAA;AAAA,MACtF;AACA,MAAA,IAAI;AACH,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,OAAA,CAAQ,OAAA,EAAS,OAAO,WAAW,CAAA;AAChE,QAAA,IAAI,OAAA,CAAQ,YAAA,CAAa,MAAM,CAAA,EAAG;AACjC,UAAA,MAAA,CAAO,SAAS,CAAA;AAChB,UAAA,MAAM,QAAQ,SAAA,GAAY,EAAE,SAAS,MAAA,EAAQ,SAAA,EAAW,OAAO,CAAA;AAC/D,UAAA,OAAO,MAAA;AAAA,QACR;AAEA,QAAA,SAAA,GAAY,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA,IAAK,sCAAA;AACxC,QAAA,MAAM,UAAU,OAAA,CAAQ,eAAA,GACrB,OAAA,CAAQ,eAAA,CAAgB,MAAM,CAAA,GAC9B,mBAAA;AACH,QAAA,MAAA,CAAO,6BAAA,CAA8B,OAAO,CAAC,CAAA;AAC7C,QAAA,IAAI,YACH,yBAAA,CAA0B,OAAA,EAAS,OAAO,UAAU,CAAA,IAAK,UAAU,MAAA,CAAO,WAAA;AAC3E,QAAA,OAAA,GAAU,SAAA,GAAY,YAAA,CAAa,OAAO,CAAA,GAAI,KAAA,CAAA;AAC9C,QAAA,IAAI,SAAS,SAAA,GAAY,KAAA;AACzB,QAAA,MAAM,WAAA,GAAc,SAAA,GAAY,eAAA,CAAgB,OAAA,EAAS,MAAM,CAAA,GAAI,KAAA,CAAA;AACnE,QAAA,MAAM,OAAA,CAAQ,YAAY,EAAE,OAAA,EAAS,QAAQ,KAAA,EAAO,SAAA,EAAW,SAAA,EAAW,WAAA,EAAa,CAAA;AAEvF,QAAA,IAAI,CAAC,SAAA,IAAa,CAAC,OAAA,EAAS;AAC3B,UAAA,OAAO,MAAA;AAAA,QACR;AAEA,QAAA,IAAI,CAAC,OAAA,EAAS,MAAM,KAAA,CAAM,eAAe,CAAC,CAAA;AAAA,MAC3C,SAAS,KAAA,EAAO;AACf,QAAA,MAAM,QAAA,GAAW,MAAM,YAAA,CAAa,KAAK,CAAA;AACzC,QAAA,IAAI,QAAA,KAAa,WAAW,MAAM,KAAA;AAClC,QAAA,OAAA,GAAU,QAAA,KAAa,UAAU,MAAA,GAAY,QAAA;AAAA,MAC9C;AAAA,IACD;AAEA,IAAA,IAAI,OAAA,IAAW,SAAS,MAAM,gBAAA,CAAiB,SAAS,OAAA,EAAS,OAAA,GAAU,GAAG,SAAS,CAAA;AAAA,EACxF;AAEA,EAAA,MAAM,IAAI,KAAA,CAAM,SAAA,IAAa,yBAAyB,CAAA;AACvD;AAMA,SAAS,aAAa,OAAA,EAAiF;AACtG,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,MAAM,OAAA,GAAU,QAAQ,KAAA,EAAM;AAC9B,EAAA,OAAO,OAAA,CAAQ,UAAU,MAAA,GAAY,OAAA;AACtC","file":"chunk-IF6NJORI.cjs","sourcesContent":["import type {\n\tAdapterCircuitBreakerConfig,\n\tAdapterCircuitBreakerManualOverride,\n\tAdapterImplementation,\n\tAdapterOutcomeKind,\n} from \"./index\";\n\n/**\n * State of an adapter circuit breaker.\n *\n * - `closed`: calls flow and outcomes are counted.\n * - `open`: the dependency is presumed unhealthy. In `enforce` mode calls are\n *   rejected without being attempted until `cooldownMs` has elapsed.\n * - `half_open`: the cooldown elapsed. One probe call is admitted; its outcome\n *   closes the breaker (success) or reopens it (failure).\n */\nexport type AdapterCircuitState = \"closed\" | \"open\" | \"half_open\";\n\n/**\n * How a single adapter outcome counts toward the breaker.\n *\n * - `success`: the dependency answered and the call succeeded.\n * - `failure`: evidence the dependency is unhealthy.\n * - `ignored`: the dependency answered but rejected the request on its merits\n *   (a validation or business rejection). It is neither a success nor a\n *   dependency failure and does not enter the rolling window.\n */\nexport type AdapterCircuitOutcome = \"success\" | \"failure\" | \"ignored\";\n\n/**\n * Map an {@link AdapterOutcomeKind} to how it counts toward a circuit breaker.\n *\n * | Outcome kind        | Counts as |\n * |---------------------|-----------|\n * | `success`           | `success` |\n * | `transient_failure` | `failure` |\n * | `timeout`           | `failure` |\n * | `ambiguous`         | `failure` |\n * | `permanent_failure` | `ignored` |\n *\n * `ambiguous` counts as a failure: the dependency did not give a definite\n * answer, which is a health signal even though the Host routes the invocation\n * to reconciliation. `permanent_failure` (validation or rejection) is the\n * dependency working correctly and saying no, so it does not trip the breaker.\n * `executeWithAdapterRetry` classifies a thrown error with the caller's\n * `classifyThrownError` (default `transient_failure`) and maps that kind here,\n * so an unclassified thrown error counts as a failure.\n */\nexport function classifyCircuitBreakerOutcome(kind: AdapterOutcomeKind): AdapterCircuitOutcome {\n\tswitch (kind) {\n\t\tcase \"success\":\n\t\t\treturn \"success\";\n\t\tcase \"permanent_failure\":\n\t\t\treturn \"ignored\";\n\t\tcase \"transient_failure\":\n\t\tcase \"timeout\":\n\t\tcase \"ambiguous\":\n\t\t\treturn \"failure\";\n\t\tdefault:\n\t\t\t// An unknown kind is treated as a dependency failure (fail closed).\n\t\t\treturn \"failure\";\n\t}\n}\n\n/** The answer a breaker gives before a call. */\nexport interface AdapterCircuitAdmission {\n\t/**\n\t * Whether the call may proceed. Always `true` in `monitor` mode; `false`\n\t * only in `enforce` mode while the breaker is open, forced open, or\n\t * half-open with its probe already in flight.\n\t */\n\tallowed: boolean;\n\t/** State at the time of the decision. */\n\tstate: AdapterCircuitState;\n\t/** True when this admission is the half-open probe. Pass it back to `record`. */\n\tprobe: boolean;\n\t/** Monitor mode only: true when `enforce` mode would have rejected this call. */\n\twouldReject?: boolean;\n\t/**\n\t * Milliseconds until the breaker will admit a probe, when known. Absent while\n\t * a manual `force_open` override is set or a half-open probe is in flight.\n\t */\n\tretryAfterMs?: number;\n\t/** Set when a manual override decided the admission. */\n\tmanualOverride?: AdapterCircuitBreakerManualOverride;\n\t/**\n\t * The breaker epoch the admission was granted in; opaque to callers.\n\t * {@link InMemoryAdapterCircuitBreaker} lets an outcome change state only\n\t * when this still matches its current epoch. An admission without it is\n\t * treated as current.\n\t */\n\tgeneration?: number;\n}\n\n/**\n * Contract between a circuit breaker and `executeWithAdapterRetry`.\n * Implement it to plug in a shared or distributed breaker.\n */\nexport interface AdapterCircuitBreaker {\n\t/** `adapterType:operation` this breaker guards. */\n\treadonly key: string;\n\treadonly mode: \"monitor\" | \"enforce\";\n\t/** Current state, applying any elapsed cooldown or manual override. */\n\tgetState(): AdapterCircuitState;\n\t/**\n\t * Preview whether a call would be admitted now. Side-effect free: it does\n\t * not commit an elapsed cooldown, take the half-open probe or emit\n\t * telemetry.\n\t */\n\tcheck(): AdapterCircuitAdmission;\n\t/**\n\t * Decide whether a call may start now. Call it immediately before the\n\t * external effect and pass the returned admission to {@link record}.\n\t */\n\tacquire(): AdapterCircuitAdmission;\n\t/**\n\t * Record the outcome of a call that was admitted by {@link acquire}. Pass\n\t * that admission, not a {@link check} preview, so the breaker can tell a\n\t * stale outcome from a current one.\n\t */\n\trecord(outcome: AdapterCircuitOutcome, admission?: AdapterCircuitAdmission): void;\n}\n\nexport type AdapterCircuitBreakerEventReason =\n\t| \"failure_threshold\"\n\t| \"cooldown_elapsed\"\n\t| \"probe_succeeded\"\n\t| \"probe_failed\"\n\t| \"manual_override\"\n\t| \"manual_override_cleared\";\n\ninterface AdapterCircuitBreakerEventBase {\n\tkey: string;\n\tmode: \"monitor\" | \"enforce\";\n\t/** Epoch milliseconds from the breaker's clock. */\n\tat: number;\n}\n\n/** Telemetry reported by {@link InMemoryAdapterCircuitBreaker}. */\nexport type AdapterCircuitBreakerEvent =\n\t| (AdapterCircuitBreakerEventBase & {\n\t\t\ttype: \"state_change\";\n\t\t\tfrom: AdapterCircuitState;\n\t\t\tto: AdapterCircuitState;\n\t\t\treason: AdapterCircuitBreakerEventReason;\n\t\t\tmanualOverride?: AdapterCircuitBreakerManualOverride;\n\t  })\n\t| (AdapterCircuitBreakerEventBase & {\n\t\t\t/** Enforce mode refused a call; it was not attempted. */\n\t\t\ttype: \"rejected\";\n\t\t\tstate: AdapterCircuitState;\n\t\t\tretryAfterMs?: number;\n\t\t\tmanualOverride?: AdapterCircuitBreakerManualOverride;\n\t  })\n\t| (AdapterCircuitBreakerEventBase & {\n\t\t\t/** Monitor mode let a call through that enforce mode would have refused. */\n\t\t\ttype: \"would_reject\";\n\t\t\tstate: AdapterCircuitState;\n\t\t\tretryAfterMs?: number;\n\t\t\tmanualOverride?: AdapterCircuitBreakerManualOverride;\n\t  });\n\n/**\n * Telemetry callback. Errors it throws and promises it rejects are caught\n * and discarded so telemetry cannot change an adapter call's outcome.\n *\n * {@link InMemoryAdapterCircuitBreaker} calls it only after the operation that\n * produced the event has committed, never part-way through a decision or a\n * record. A callback may call back into the breaker; it sees committed state,\n * and events its own calls produce are delivered after it returns, in order.\n */\nexport type AdapterCircuitBreakerEventListener = (\n\tevent: AdapterCircuitBreakerEvent,\n) => void | Promise<void>;\n\nexport interface InMemoryAdapterCircuitBreakerOptions {\n\t/** Usually `adapterType:operation`. */\n\tkey: string;\n\tconfig: AdapterCircuitBreakerConfig;\n\t/** Epoch-millisecond clock. Defaults to `Date.now`. */\n\tnow?: () => number;\n\tonEvent?: AdapterCircuitBreakerEventListener;\n}\n\nconst MANUAL_OVERRIDES: readonly AdapterCircuitBreakerManualOverride[] = [\"force_open\", \"force_closed\"];\n\n/**\n * Validate a circuit-breaker config. Throws a `RangeError` naming the first\n * invalid field: `mode` must be `monitor` or `enforce`; `failureThreshold` and\n * `minimumSamples` positive integers; `windowMs` and `probeLeaseMs` positive\n * finite numbers; `cooldownMs` a non-negative finite number; `manualOverride`\n * `force_open` or `force_closed` when present.\n */\nexport function assertAdapterCircuitBreakerConfig(config: AdapterCircuitBreakerConfig): void {\n\tif (!config || typeof config !== \"object\") {\n\t\tthrow new RangeError(\"Adapter circuit breaker config must be an object.\");\n\t}\n\tif (config.mode !== \"monitor\" && config.mode !== \"enforce\") {\n\t\tthrow new RangeError(`Adapter circuit breaker mode must be \"monitor\" or \"enforce\"; got ${JSON.stringify(config.mode)}.`);\n\t}\n\tif (!Number.isInteger(config.failureThreshold) || config.failureThreshold < 1) {\n\t\tthrow new RangeError(`Adapter circuit breaker failureThreshold must be a positive integer; got ${String(config.failureThreshold)}.`);\n\t}\n\tif (typeof config.windowMs !== \"number\" || !Number.isFinite(config.windowMs) || config.windowMs <= 0) {\n\t\tthrow new RangeError(`Adapter circuit breaker windowMs must be a positive number of milliseconds; got ${String(config.windowMs)}.`);\n\t}\n\tif (typeof config.cooldownMs !== \"number\" || !Number.isFinite(config.cooldownMs) || config.cooldownMs < 0) {\n\t\tthrow new RangeError(`Adapter circuit breaker cooldownMs must be a non-negative number of milliseconds; got ${String(config.cooldownMs)}.`);\n\t}\n\tif (\n\t\tconfig.minimumSamples !== undefined &&\n\t\t(!Number.isInteger(config.minimumSamples) || config.minimumSamples < 1)\n\t) {\n\t\tthrow new RangeError(`Adapter circuit breaker minimumSamples must be a positive integer; got ${String(config.minimumSamples)}.`);\n\t}\n\tif (\n\t\tconfig.probeLeaseMs !== undefined &&\n\t\t(typeof config.probeLeaseMs !== \"number\" || !Number.isFinite(config.probeLeaseMs) || config.probeLeaseMs <= 0)\n\t) {\n\t\tthrow new RangeError(`Adapter circuit breaker probeLeaseMs must be a positive number of milliseconds; got ${String(config.probeLeaseMs)}.`);\n\t}\n\tif (config.manualOverride !== undefined && !MANUAL_OVERRIDES.includes(config.manualOverride)) {\n\t\tthrow new RangeError(`Adapter circuit breaker manualOverride must be \"force_open\" or \"force_closed\"; got ${JSON.stringify(config.manualOverride)}.`);\n\t}\n}\n\ninterface Sample {\n\tat: number;\n\tfailure: boolean;\n}\n\n/**\n * Dependency-free, in-process circuit breaker for one adapter operation.\n *\n * State lives in this instance only: it is not shared between processes,\n * hosts, or replicas, and it is lost on restart. Each replica trips on the\n * failures it observes itself.\n *\n * Tripping rule (parity with the .NET `InMemoryAdapterCircuitBreaker`): after\n * a failure is recorded while `closed`, let `N` be the outcomes recorded within\n * the last `windowMs` and `M = minimumSamples ?? failureThreshold`. The breaker\n * opens when `N >= M` and either\n * 1. the most recent `failureThreshold` outcomes in the window are all\n *    failures, or\n * 2. the failure ratio in the window is at least `failureThreshold / M`.\n *\n * With `minimumSamples` omitted this reads \"`failureThreshold` consecutive\n * failures\". With `minimumSamples: 20, failureThreshold: 10` it also opens at\n * a 50% failure rate over at least 20 calls.\n *\n * After `cooldownMs` the breaker turns `half_open` and admits one probe. A\n * probe success closes it and clears the window; a probe failure reopens it\n * and restarts the cooldown. At most one probe is outstanding at a time: it\n * holds a lease of `probeLeaseMs` (default `max(cooldownMs, windowMs)`, never\n * derived from the cooldown alone, so `cooldownMs: 0` still admits one probe).\n * A probe that has not recorded when its lease expires is considered lost and\n * the next call becomes the probe.\n *\n * Epochs: the breaker keeps a generation counter that advances on every state\n * change (including one committed by an elapsed cooldown), every manual\n * override change, and every probe grant. Each admission carries the\n * generation it was granted in. `record` first commits any elapsed cooldown,\n * then compares generations. An outcome from an earlier epoch is stale: it is\n * dropped entirely. It changes no state, does not resolve or free the probe\n * slot, and is not added to the rolling window, so it cannot contribute to a\n * later trip either. Because a probe grant starts a new epoch, the outstanding\n * probe is the only `probe: true` admission of the current epoch, which is how\n * a replaced probe's late outcome is told apart. An outcome recorded without an\n * admission, or with one that has no `generation`, is treated as current: it is\n * sampled, can trip a closed breaker and resolves an outstanding probe.\n *\n * Telemetry is buffered and delivered after each operation commits. An\n * elapsed cooldown is committed, and its `cooldown_elapsed` event delivered,\n * as a step of its own before `acquire`, `record`, `getState` or\n * `setManualOverride` continues, so a callback reacting to it (for example by\n * forcing the breaker open) governs the call that observed it. Every other\n * event is delivered once the method's decision or record is final, and a\n * callback never revokes an admission that is already committed. Two cases\n * follow from that: a breaker call made from inside a callback queues its own\n * `cooldown_elapsed` behind the current delivery and decides first; and with\n * `cooldownMs: 0`, a cooldown that falls due again during the decision (because\n * a callback reopened the breaker) is committed and admitted before its event\n * is delivered.\n *\n * `monitor` mode runs the same state machine and reports the same telemetry\n * but admits every call; calls enforce mode would have refused are reported\n * as `would_reject`.\n *\n * A manual override pins the reported state (`force_open` → `open`,\n * `force_closed` → `closed`) and suspends automatic transitions while set;\n * outcomes of calls admitted under the override are still recorded. Like an\n * automatic open, `force_open` blocks only in `enforce` mode. Clearing the\n * override returns the breaker to `closed` with its window intact.\n */\nexport class InMemoryAdapterCircuitBreaker implements AdapterCircuitBreaker {\n\treadonly key: string;\n\treadonly mode: \"monitor\" | \"enforce\";\n\tprivate readonly config: AdapterCircuitBreakerConfig;\n\tprivate readonly now: () => number;\n\tprivate readonly onEvent: AdapterCircuitBreakerEventListener | undefined;\n\tprivate readonly probeLeaseMs: number;\n\tprivate samples: Sample[] = [];\n\tprivate state: AdapterCircuitState = \"closed\";\n\tprivate openedAt = 0;\n\tprivate probeIssuedAt: number | undefined;\n\t/** Advances on every state change, manual override change and probe grant. */\n\tprivate generation = 0;\n\tprivate manualOverride: AdapterCircuitBreakerManualOverride | undefined;\n\t/** Telemetry waiting for the current operation to commit. */\n\tprivate readonly outbox: AdapterCircuitBreakerEvent[] = [];\n\tprivate operationDepth = 0;\n\tprivate flushing = false;\n\n\tconstructor(options: InMemoryAdapterCircuitBreakerOptions) {\n\t\tassertAdapterCircuitBreakerConfig(options.config);\n\t\tthis.key = options.key;\n\t\tthis.config = { ...options.config };\n\t\tthis.mode = options.config.mode;\n\t\tthis.now = options.now ?? Date.now;\n\t\tthis.onEvent = options.onEvent;\n\t\tthis.manualOverride = options.config.manualOverride;\n\t\tthis.probeLeaseMs = options.config.probeLeaseMs ?? Math.max(options.config.cooldownMs, options.config.windowMs);\n\t}\n\n\tgetState(): AdapterCircuitState {\n\t\tthis.settle(this.now());\n\t\treturn this.reportedState();\n\t}\n\n\tgetManualOverride(): AdapterCircuitBreakerManualOverride | undefined {\n\t\treturn this.manualOverride;\n\t}\n\n\t/**\n\t * Set (`force_open` / `force_closed`) or clear (`undefined`) the manual\n\t * override. Clearing returns the breaker to `closed` with its window intact.\n\t */\n\tsetManualOverride(override: AdapterCircuitBreakerManualOverride | undefined): void {\n\t\tif (override !== undefined && !MANUAL_OVERRIDES.includes(override)) {\n\t\t\tthrow new RangeError(`Adapter circuit breaker manualOverride must be \"force_open\" or \"force_closed\"; got ${JSON.stringify(override)}.`);\n\t\t}\n\t\tconst now = this.now();\n\t\tthis.settle(now);\n\t\t// Compared after settle: a telemetry callback may have set this override.\n\t\tif (override === this.manualOverride) return;\n\t\tthis.operation(() => {\n\t\t\tconst from = this.reportedState();\n\t\t\tthis.manualOverride = override;\n\t\t\tthis.generation++;\n\t\t\tif (override === undefined) {\n\t\t\t\tthis.state = \"closed\";\n\t\t\t\tthis.releaseProbe();\n\t\t\t}\n\t\t\tthis.emit({\n\t\t\t\ttype: \"state_change\",\n\t\t\t\tkey: this.key,\n\t\t\t\tmode: this.mode,\n\t\t\t\tat: now,\n\t\t\t\tfrom,\n\t\t\t\tto: this.reportedState(),\n\t\t\t\treason: override === undefined ? \"manual_override_cleared\" : \"manual_override\",\n\t\t\t\t...(override ? { manualOverride: override } : {}),\n\t\t\t});\n\t\t});\n\t}\n\n\tcheck(): AdapterCircuitAdmission {\n\t\treturn this.decide(false, this.now());\n\t}\n\n\tacquire(): AdapterCircuitAdmission {\n\t\tconst now = this.now();\n\t\tthis.settle(now);\n\t\treturn this.operation(() => this.decide(true, now));\n\t}\n\n\trecord(outcome: AdapterCircuitOutcome, admission?: AdapterCircuitAdmission): void {\n\t\tconst now = this.now();\n\t\t// Commit an elapsed cooldown first, so an outcome admitted while open\n\t\t// is judged against the half_open epoch it would otherwise influence.\n\t\tthis.settle(now);\n\t\tthis.operation(() => this.applyOutcome(outcome, admission, now));\n\t}\n\n\tprivate applyOutcome(outcome: AdapterCircuitOutcome, admission: AdapterCircuitAdmission | undefined, now: number): void {\n\t\tconst generation = admission?.generation;\n\t\t// Stale: admitted in an earlier epoch. No transition, no probe release, no sample.\n\t\tif (generation !== undefined && generation !== this.generation) return;\n\t\t// In the current epoch the only probe admission is the outstanding probe.\n\t\tconst resolvesProbe =\n\t\t\tthis.state === \"half_open\" &&\n\t\t\tthis.probeIssuedAt !== undefined &&\n\t\t\t(generation === undefined || admission?.probe === true);\n\t\tif (outcome === \"ignored\") {\n\t\t\t// The dependency answered; the probe proved nothing either way.\n\t\t\tif (resolvesProbe) this.releaseProbe();\n\t\t\treturn;\n\t\t}\n\t\tthis.prune(now);\n\t\tthis.samples.push({ at: now, failure: outcome === \"failure\" });\n\t\tif (this.manualOverride) return;\n\t\tif (resolvesProbe) {\n\t\t\tthis.releaseProbe();\n\t\t\tif (outcome === \"success\") {\n\t\t\t\tthis.samples = [];\n\t\t\t\tthis.transition(\"closed\", \"probe_succeeded\", now);\n\t\t\t} else {\n\t\t\t\tthis.openedAt = now;\n\t\t\t\tthis.transition(\"open\", \"probe_failed\", now);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tif (this.state === \"closed\" && outcome === \"failure\" && this.shouldTrip()) {\n\t\t\tthis.openedAt = now;\n\t\t\tthis.transition(\"open\", \"failure_threshold\", now);\n\t\t}\n\t}\n\n\t/**\n\t * `take` is false for {@link check}: a pure preview that sees an elapsed\n\t * cooldown without committing it, takes no probe and emits nothing.\n\t */\n\tprivate decide(take: boolean, now: number): AdapterCircuitAdmission {\n\t\tif (this.manualOverride === \"force_closed\") {\n\t\t\treturn { allowed: true, state: \"closed\", probe: false, manualOverride: \"force_closed\", generation: this.generation };\n\t\t}\n\t\tif (this.manualOverride === \"force_open\") {\n\t\t\treturn this.refuse(take, { state: \"open\", manualOverride: \"force_open\" });\n\t\t}\n\t\t// An elapsed cooldown releases any probe, so a pending open → half_open\n\t\t// transition always has its probe free.\n\t\tconst cooldownElapsed = this.state === \"open\" && now - this.openedAt >= this.config.cooldownMs;\n\t\t// Normally a no-op: acquire() settled first. A listener run by that\n\t\t// settle can reopen the breaker (with cooldownMs 0 it is due at once);\n\t\t// that cooldown is committed here and reported after the decision.\n\t\tif (take) this.advance(now);\n\t\tconst state: AdapterCircuitState = !take && cooldownElapsed ? \"half_open\" : this.state;\n\t\tif (state === \"closed\") return { allowed: true, state: \"closed\", probe: false, generation: this.generation };\n\t\tif (state === \"open\") {\n\t\t\treturn this.refuse(take, {\n\t\t\t\tstate: \"open\",\n\t\t\t\tretryAfterMs: Math.max(0, this.openedAt + this.config.cooldownMs - now),\n\t\t\t});\n\t\t}\n\t\t// half_open: one probe at a time, until it records or its lease expires.\n\t\tconst probeFree =\n\t\t\t(!take && cooldownElapsed) ||\n\t\t\tthis.probeIssuedAt === undefined ||\n\t\t\tnow - this.probeIssuedAt >= this.probeLeaseMs;\n\t\tif (!probeFree) return this.refuse(take, { state: \"half_open\" });\n\t\tif (!take) return { allowed: true, state: \"half_open\", probe: true, generation: this.generation };\n\t\t// Granting the probe starts a new epoch, so a replaced probe's token goes stale.\n\t\tthis.probeIssuedAt = now;\n\t\tthis.generation++;\n\t\treturn { allowed: true, state: \"half_open\", probe: true, generation: this.generation };\n\t}\n\n\tprivate refuse(\n\t\ttake: boolean,\n\t\tdetail: { state: AdapterCircuitState; retryAfterMs?: number; manualOverride?: AdapterCircuitBreakerManualOverride },\n\t): AdapterCircuitAdmission {\n\t\tconst enforce = this.mode === \"enforce\";\n\t\tif (take) {\n\t\t\tthis.emit({\n\t\t\t\ttype: enforce ? \"rejected\" : \"would_reject\",\n\t\t\t\tkey: this.key,\n\t\t\t\tmode: this.mode,\n\t\t\t\tat: this.now(),\n\t\t\t\t...detail,\n\t\t\t});\n\t\t}\n\t\tconst generation = this.generation;\n\t\treturn enforce\n\t\t\t? { allowed: false, probe: false, ...detail, generation }\n\t\t\t: { allowed: true, probe: false, wouldReject: true, ...detail, generation };\n\t}\n\n\tprivate releaseProbe(): void {\n\t\tthis.probeIssuedAt = undefined;\n\t}\n\n\t/** Apply the time-based open → half_open transition. */\n\tprivate advance(now: number): void {\n\t\tif (this.state === \"open\" && now - this.openedAt >= this.config.cooldownMs) {\n\t\t\tthis.releaseProbe();\n\t\t\tthis.transition(\"half_open\", \"cooldown_elapsed\", now);\n\t\t}\n\t}\n\n\tprivate shouldTrip(): boolean {\n\t\tconst minimumSamples = this.config.minimumSamples ?? this.config.failureThreshold;\n\t\tconst total = this.samples.length;\n\t\tif (total < minimumSamples) return false;\n\t\tlet consecutive = 0;\n\t\tfor (let index = total - 1; index >= 0 && this.samples[index]!.failure; index--) consecutive++;\n\t\tif (consecutive >= this.config.failureThreshold) return true;\n\t\tconst failures = this.samples.reduce((count, sample) => count + (sample.failure ? 1 : 0), 0);\n\t\treturn failures / total >= this.config.failureThreshold / minimumSamples;\n\t}\n\n\tprivate prune(now: number): void {\n\t\tconst cutoff = now - this.config.windowMs;\n\t\tlet drop = 0;\n\t\twhile (drop < this.samples.length && this.samples[drop]!.at < cutoff) drop++;\n\t\tif (drop > 0) this.samples.splice(0, drop);\n\t}\n\n\tprivate transition(to: AdapterCircuitState, reason: AdapterCircuitBreakerEventReason, at: number): void {\n\t\tconst from = this.state;\n\t\tif (from === to) return;\n\t\tthis.state = to;\n\t\tthis.generation++;\n\t\tthis.emit({ type: \"state_change\", key: this.key, mode: this.mode, at, from, to, reason });\n\t}\n\n\tprivate reportedState(): AdapterCircuitState {\n\t\tif (this.manualOverride) return this.manualOverride === \"force_open\" ? \"open\" : \"closed\";\n\t\treturn this.state;\n\t}\n\n\t/**\n\t * Commit an elapsed cooldown as an operation of its own, delivering its\n\t * event before the caller's operation reads state.\n\t */\n\tprivate settle(now: number): void {\n\t\tif (this.manualOverride) return;\n\t\tthis.operation(() => this.advance(now));\n\t}\n\n\t/**\n\t * Run `step` to completion, then deliver the telemetry it produced. The\n\t * return value is fixed before any listener runs.\n\t */\n\tprivate operation<T>(step: () => T): T {\n\t\tthis.operationDepth++;\n\t\ttry {\n\t\t\treturn step();\n\t\t} finally {\n\t\t\tthis.operationDepth--;\n\t\t\tif (this.operationDepth === 0) this.flush();\n\t\t}\n\t}\n\n\tprivate emit(event: AdapterCircuitBreakerEvent): void {\n\t\tif (this.onEvent) this.outbox.push(event);\n\t}\n\n\t/**\n\t * Deliver buffered events in order. A listener that calls back into the\n\t * breaker queues its own events; this loop delivers them after it returns\n\t * instead of recursing.\n\t */\n\tprivate flush(): void {\n\t\tif (this.flushing) return;\n\t\tthis.flushing = true;\n\t\ttry {\n\t\t\tfor (let event = this.outbox.shift(); event; event = this.outbox.shift()) this.deliver(event);\n\t\t} finally {\n\t\t\tthis.flushing = false;\n\t\t}\n\t}\n\n\tprivate deliver(event: AdapterCircuitBreakerEvent): void {\n\t\tconst listener = this.onEvent;\n\t\tif (!listener) return;\n\t\ttry {\n\t\t\tconst result = listener(event);\n\t\t\tif (result && typeof (result as PromiseLike<void>).then === \"function\") {\n\t\t\t\t(result as PromiseLike<void>).then(undefined, () => undefined);\n\t\t\t}\n\t\t} catch {\n\t\t\t// Telemetry must never change an adapter call's outcome.\n\t\t}\n\t}\n}\n\n/** Supplies the breaker, if any, that guards an adapter. */\nexport interface AdapterCircuitBreakerProvider {\n\tforAdapter(adapter: AdapterImplementation): AdapterCircuitBreaker | undefined;\n}\n\nexport interface AdapterCircuitBreakerRegistryOptions {\n\t/** Epoch-millisecond clock handed to every breaker. Defaults to `Date.now`. */\n\tnow?: () => number;\n\tonEvent?: AdapterCircuitBreakerEventListener;\n}\n\n/**\n * Lazily creates one {@link InMemoryAdapterCircuitBreaker} per\n * `adapterType:operation`, from that adapter's own `circuitBreaker` config.\n * Adapters without a config get no breaker. The first config seen for a key\n * wins; share a registry only between hosts that register the same adapters.\n */\nexport class AdapterCircuitBreakerRegistry implements AdapterCircuitBreakerProvider {\n\tprivate readonly breakers = new Map<string, InMemoryAdapterCircuitBreaker>();\n\n\tconstructor(private readonly options: AdapterCircuitBreakerRegistryOptions = {}) {}\n\n\tforAdapter(adapter: AdapterImplementation): InMemoryAdapterCircuitBreaker | undefined {\n\t\tif (!adapter.circuitBreaker) return undefined;\n\t\tconst key = `${adapter.adapterType}:${adapter.operation}`;\n\t\tlet breaker = this.breakers.get(key);\n\t\tif (!breaker) {\n\t\t\tbreaker = new InMemoryAdapterCircuitBreaker({\n\t\t\t\tkey,\n\t\t\t\tconfig: adapter.circuitBreaker,\n\t\t\t\t...(this.options.now ? { now: this.options.now } : {}),\n\t\t\t\t...(this.options.onEvent ? { onEvent: this.options.onEvent } : {}),\n\t\t\t});\n\t\t\tthis.breakers.set(key, breaker);\n\t\t}\n\t\treturn breaker;\n\t}\n\n\t/** The breaker already created for `adapterType:operation`, if any. */\n\tget(adapterType: string, operation: string): InMemoryAdapterCircuitBreaker | undefined {\n\t\treturn this.breakers.get(`${adapterType}:${operation}`);\n\t}\n}\n\n/**\n * Thrown by `executeWithAdapterRetry` when an `enforce`-mode breaker refuses\n * an attempt. The refused attempt never reached `execute`, so no external\n * effect happened for it.\n */\nexport class AdapterCircuitOpenError extends Error {\n\toverride readonly name = \"AdapterCircuitOpenError\";\n\treadonly code = \"ADAPTER_CIRCUIT_OPEN\" as const;\n\treadonly reason = \"circuit_open\" as const;\n\treadonly adapterKey: string;\n\treadonly state: AdapterCircuitState;\n\t/** The attempt number that was refused (1 = refused before any call). */\n\treadonly attempt: number;\n\treadonly retryAfterMs?: number;\n\treadonly manualOverride?: AdapterCircuitBreakerManualOverride;\n\t/** Error of the previous attempt, when the breaker opened mid-retry. */\n\treadonly lastError?: string;\n\n\tconstructor(input: {\n\t\tadapterKey: string;\n\t\tstate: AdapterCircuitState;\n\t\tattempt: number;\n\t\tretryAfterMs?: number;\n\t\tmanualOverride?: AdapterCircuitBreakerManualOverride;\n\t\tlastError?: string;\n\t}) {\n\t\tconst after = input.retryAfterMs !== undefined ? `; retry after ${input.retryAfterMs} ms` : \"\";\n\t\tsuper(`Adapter circuit is ${input.state === \"half_open\" ? \"half-open with its probe in flight\" : \"open\"} for ${input.adapterKey}; the call was not attempted${after}.`);\n\t\tthis.adapterKey = input.adapterKey;\n\t\tthis.state = input.state;\n\t\tthis.attempt = input.attempt;\n\t\tif (input.retryAfterMs !== undefined) this.retryAfterMs = input.retryAfterMs;\n\t\tif (input.manualOverride !== undefined) this.manualOverride = input.manualOverride;\n\t\tif (input.lastError !== undefined) this.lastError = input.lastError;\n\t}\n}\n\n/**\n * Recognise an {@link AdapterCircuitOpenError}, including one constructed by a\n * second copy of this package (for example an ESM and a CommonJS build loaded\n * side by side), where `instanceof` fails.\n */\nexport function isAdapterCircuitOpenError(error: unknown): error is AdapterCircuitOpenError {\n\tif (error instanceof AdapterCircuitOpenError) return true;\n\treturn (\n\t\ttypeof error === \"object\" &&\n\t\terror !== null &&\n\t\t(error as { name?: unknown }).name === \"AdapterCircuitOpenError\" &&\n\t\t(error as { code?: unknown }).code === \"ADAPTER_CIRCUIT_OPEN\"\n\t);\n}\n","import {\n\tAdapterCircuitOpenError,\n\tclassifyCircuitBreakerOutcome,\n\ttype AdapterCircuitAdmission,\n\ttype AdapterCircuitBreaker,\n\ttype AdapterCircuitOutcome,\n} from \"./circuit-breaker\";\n\nexport * from \"./circuit-breaker\";\n\nexport interface AdapterExecutionContext {\n\ttenantId: string;\n\tspaceId: string;\n\tactionInvocationId: string;\n\tadapterInvocationId: string;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tattempt: number;\n\tmaxAttempts: number;\n\t/** Epoch-millis deadline after which the adapter should abandon the call. */\n\tdeadlineMs?: number;\n\t/** Set by the host when the invocation has been cancelled; adapters should stop work. */\n\tcancelled?: boolean;\n\t/** Non-secret reason the invocation was cancelled. */\n\tcancellationReason?: string;\n\t/**\n\t * AbortSignal the host aborts when the deadline expires or the invocation is\n\t * cancelled. Adapters should propagate this to underlying HTTP/database\n\t * clients so in-flight work is abandoned rather than left dangling.\n\t */\n\tsignal?: AbortSignal;\n}\n\n/**\n * Additive classification of an adapter outcome so the retry layer can\n * distinguish retryable transient failures from permanent rejections,\n * timeouts, and ambiguous results that require manual reconciliation.\n *\n * When `outcome` is absent on an {@link AdapterExecutionResult}, the retry\n * layer treats a non-success result as `transient_failure` for backward\n * compatibility.\n */\nexport type AdapterOutcomeKind =\n\t| \"success\"\n\t| \"transient_failure\"\n\t| \"permanent_failure\"\n\t| \"timeout\"\n\t| \"ambiguous\";\n\n/**\n * Durable, non-secret evidence attached to a classified adapter outcome.\n * Used by the host to record reconciliation evidence when an adapter returns\n * an ambiguous result whose external effect may or may not have been applied.\n */\nexport interface AdapterOutcomeEvidence {\n\tkind: AdapterOutcomeKind;\n\treason?: string;\n\t/** Opaque, non-secret reference to external operation state for reconciliation. */\n\texternalReference?: string;\n\t/** Whether the external effect may have been applied (true for ambiguous/timeout). */\n\teffectMayHaveApplied?: boolean;\n\tobservedAt: Date | string;\n}\n\n/**\n * An adapter handed the work to an external system that will finish it later.\n *\n * Explicit rather than inferred from evidence: a successful adapter call that\n * merely records a reference is not the same as one that has left the outcome\n * in someone else's hands. The host keeps the invocation running and expects a\n * completion carrying this reference through its completion ingress.\n */\nexport interface AcceptedExternalOperation {\n\t/** Opaque, non-secret reference the external system will complete by. */\n\texternalReference: string;\n\t/** When the external system said it expects to finish, if it said. */\n\texpectedBy?: Date | string;\n}\n\nexport interface AdapterExecutionResult {\n\tsuccess: boolean;\n\tcorrelationId?: string;\n\terror?: string;\n\t/** Additive outcome classification. Omitted = infer from `success`. */\n\toutcome?: AdapterOutcomeKind;\n\t/** Durable evidence for ambiguous or timeout outcomes requiring reconciliation. */\n\toutcomeEvidence?: AdapterOutcomeEvidence;\n\t/** Present when a successful call handed the work off to finish elsewhere. */\n\tacceptedExternalOperation?: AcceptedExternalOperation;\n}\n\nexport type AdapterExecutor = (\n\tinput: Record<string, unknown>,\n\tcontext: AdapterExecutionContext,\n) => Promise<AdapterExecutionResult>;\n\nexport interface AdapterRetryPolicy {\n\t/** External calls must explicitly opt into retry by being idempotent. */\n\tidempotent: boolean;\n\t/** Total attempts including the first call. Non-idempotent policies are forced to 1. */\n\tmaxAttempts?: number;\n\t/** First backoff delay in milliseconds. */\n\tinitialDelayMs?: number;\n\t/** Exponential multiplier applied after each failed attempt. */\n\tbackoffMultiplier?: number;\n\t/** Upper bound for any single retry delay in milliseconds. */\n\tmaxDelayMs?: number;\n}\n\nexport interface ResolvedAdapterRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts: number;\n\tinitialDelayMs: number;\n\tbackoffMultiplier: number;\n\tmaxDelayMs: number;\n}\n\n/** Manual circuit-breaker override: pin the breaker open or closed. */\nexport type AdapterCircuitBreakerManualOverride = \"force_open\" | \"force_closed\";\n\n/**\n * Per-adapter circuit-breaker configuration, read by\n * {@link AdapterCircuitBreakerRegistry} (and so by Platform Host) to create one\n * in-process {@link InMemoryAdapterCircuitBreaker} per `adapterType:operation`.\n * Validated by {@link assertAdapterCircuitBreakerConfig}.\n */\nexport interface AdapterCircuitBreakerConfig {\n\t/**\n\t * `monitor` records outcomes, runs the state machine and reports what it\n\t * would have refused, but never blocks a call. `enforce` refuses calls\n\t * while the breaker is open, without attempting them.\n\t */\n\tmode: \"monitor\" | \"enforce\";\n\t/**\n\t * A failure count. Let `M = minimumSamples ?? failureThreshold`. Once at\n\t * least `M` outcomes fall within `windowMs`, the breaker opens when the most\n\t * recent `failureThreshold` of them are all failures, or when the failure\n\t * ratio in the window reaches `failureThreshold / M`. Without\n\t * `minimumSamples` this is \"`failureThreshold` consecutive failures\".\n\t * Matches the .NET port's `InMemoryAdapterCircuitBreaker`. Positive integer.\n\t */\n\tfailureThreshold: number;\n\t/** Rolling window, in milliseconds, of outcomes the thresholds consider. */\n\twindowMs: number;\n\t/** Milliseconds an open breaker waits before admitting one half-open probe. */\n\tcooldownMs: number;\n\t/** Outcomes required in the window before the breaker can open. Defaults to `failureThreshold`. */\n\tminimumSamples?: number;\n\t/**\n\t * How long, in milliseconds, the single half-open probe holds its slot\n\t * before it is presumed lost and another call may probe. Defaults to\n\t * `max(cooldownMs, windowMs)`; it is independent of `cooldownMs`, so a zero\n\t * or short cooldown never admits concurrent probes. Positive.\n\t */\n\tprobeLeaseMs?: number;\n\t/**\n\t * Optional initial manual override. `force_open` reports `open` (and blocks\n\t * only in `enforce` mode); `force_closed` reports `closed` and never blocks.\n\t * Change it at runtime with `InMemoryAdapterCircuitBreaker.setManualOverride`.\n\t */\n\tmanualOverride?: AdapterCircuitBreakerManualOverride;\n}\n\nexport interface AdapterImplementation {\n\tadapterType: string;\n\toperation: string;\n\tvendor: string;\n\t/** Whether this adapter operation can be safely retried by default. */\n\tidempotent: boolean;\n\tretryPolicy?: AdapterRetryPolicy;\n\t/** Defaults to monitor-only; enforce mode must be explicitly configured. */\n\tcircuitBreaker?: AdapterCircuitBreakerConfig;\n\texecute: AdapterExecutor;\n}\n\nexport interface AdapterAttempt<T> {\n\tattempt: number;\n\tresult?: T;\n\terror?: string;\n\twillRetry: boolean;\n\tnextDelayMs?: number;\n}\n\nexport interface ExecuteWithRetryOptions<T> {\n\tpolicy?: AdapterRetryPolicy;\n\tdefaultIdempotent: boolean;\n\texecute: (attempt: number, maxAttempts: number) => Promise<T>;\n\tisSuccessful: (result: T) => boolean;\n\tgetError: (result: T) => string | undefined;\n\t/**\n\t * Optional outcome classifier. When provided, the retry layer retries only\n\t * `transient_failure` outcomes (and only when the policy is idempotent).\n\t * `permanent_failure`, `timeout`, and `ambiguous` outcomes are never retried.\n\t * When omitted, all non-success results are treated as transient (backward compatible).\n\t */\n\tclassifyOutcome?: (result: T) => AdapterOutcomeKind;\n\t/**\n\t * Optional classifier for errors thrown by the execute callback (not returned\n\t * as results). When provided, the retry layer retries only `transient_failure`\n\t * classifications. When omitted, thrown errors are never retried — the caller\n\t * must explicitly opt into retrying a thrown failure by classifying it.\n\t */\n\tclassifyThrownError?: (error: unknown) => AdapterOutcomeKind;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tonAttempt?: (attempt: AdapterAttempt<T>) => Promise<void> | void;\n\t/**\n\t * Optional per-attempt preparation, awaited before the circuit breaker is\n\t * consulted and before `execute` (for example, persisting the attempt\n\t * number). Put every await a caller needs before the call here, so that\n\t * nothing awaits between breaker admission and the external call. If it\n\t * throws, no admission is taken and no breaker outcome is recorded; the\n\t * error is classified with `classifyThrownError` and retried or rethrown\n\t * exactly like an error thrown by `execute`.\n\t */\n\tprepareAttempt?: (attempt: number, maxAttempts: number) => Promise<void> | void;\n\t/**\n\t * Optional circuit breaker. When present, `acquire()` is called\n\t * immediately before every `execute` call, with no await in between, and every attempt's outcome is\n\t * recorded through {@link classifyCircuitBreakerOutcome}. In `enforce` mode\n\t * a refused attempt is not executed and {@link AdapterCircuitOpenError} is\n\t * thrown; if the breaker opens between attempts, retrying stops and the\n\t * same error is thrown. When omitted, behaviour is unchanged.\n\t */\n\tcircuitBreaker?: AdapterCircuitBreaker;\n}\n\nfunction adapterKey(adapterType: string, operation: string): string {\n\treturn `${adapterType}:${operation}`;\n}\n\nexport class MissingAdapterRegistrationError extends Error {\n\tconstructor(adapterType: string, operation: string) {\n\t\tsuper(`No adapter registered for adapterType \"${adapterType}\" and operation \"${operation}\"`);\n\t\tthis.name = \"MissingAdapterRegistrationError\";\n\t}\n}\n\nexport class AdapterRegistry {\n\tprivate readonly adapters = new Map<string, AdapterImplementation>();\n\n\tregister(adapter: AdapterImplementation): void {\n\t\tconst key = adapterKey(adapter.adapterType, adapter.operation);\n\t\tif (this.adapters.has(key)) {\n\t\t\tthrow new Error(\n\t\t\t\t`Adapter already registered for adapterType \"${adapter.adapterType}\" and operation \"${adapter.operation}\"`,\n\t\t\t);\n\t\t}\n\n\t\tthis.adapters.set(key, adapter);\n\t}\n\n\tresolve(adapterType: string, operation: string): AdapterImplementation | undefined {\n\t\treturn this.adapters.get(adapterKey(adapterType, operation));\n\t}\n\n\trequire(adapterType: string, operation: string): AdapterImplementation {\n\t\tconst adapter = this.resolve(adapterType, operation);\n\t\tif (!adapter) {\n\t\t\tthrow new MissingAdapterRegistrationError(adapterType, operation);\n\t\t}\n\n\t\treturn adapter;\n\t}\n}\n\nconst DEFAULT_RETRY_POLICY: ResolvedAdapterRetryPolicy = {\n\tidempotent: true,\n\tmaxAttempts: 3,\n\tinitialDelayMs: 100,\n\tbackoffMultiplier: 2,\n\tmaxDelayMs: 1_000,\n};\n\nconst NO_RETRY_POLICY: ResolvedAdapterRetryPolicy = {\n\tidempotent: false,\n\tmaxAttempts: 1,\n\tinitialDelayMs: 0,\n\tbackoffMultiplier: 1,\n\tmaxDelayMs: 0,\n};\n\nexport function resolveAdapterRetryPolicy(\n\tpolicy: AdapterRetryPolicy | undefined,\n\tdefaultIdempotent: boolean,\n): ResolvedAdapterRetryPolicy {\n\tconst idempotent = policy?.idempotent ?? defaultIdempotent;\n\n\tif (!idempotent) {\n\t\treturn NO_RETRY_POLICY;\n\t}\n\n\treturn {\n\t\tidempotent: true,\n\t\tmaxAttempts: Math.max(1, Math.min(policy?.maxAttempts ?? DEFAULT_RETRY_POLICY.maxAttempts, 5)),\n\t\tinitialDelayMs: Math.max(0, policy?.initialDelayMs ?? DEFAULT_RETRY_POLICY.initialDelayMs),\n\t\tbackoffMultiplier: Math.max(\n\t\t\t1,\n\t\t\tpolicy?.backoffMultiplier ?? DEFAULT_RETRY_POLICY.backoffMultiplier,\n\t\t),\n\t\tmaxDelayMs: Math.max(0, policy?.maxDelayMs ?? DEFAULT_RETRY_POLICY.maxDelayMs),\n\t};\n}\n\nexport function getRetryDelayMs(attempt: number, policy: ResolvedAdapterRetryPolicy): number {\n\tconst exponentialDelay =\n\t\tpolicy.initialDelayMs * policy.backoffMultiplier ** Math.max(0, attempt - 1);\n\n\treturn Math.min(exponentialDelay, policy.maxDelayMs);\n}\n\n/**\n * Classify an {@link AdapterExecutionResult} into an {@link AdapterOutcomeKind}.\n * When `outcome` is explicitly set, it is returned directly, after rejecting a\n * contradictory result where `success` is true but the outcome is non-success.\n * Otherwise a successful result maps to `success` and a failed result maps to\n * `transient_failure` (the historical default).\n */\nexport function classifyAdapterOutcome(result: AdapterExecutionResult): AdapterOutcomeKind {\n\tif (result.outcome) {\n\t\tassertAdapterOutcomeConsistency(result);\n\t\treturn result.outcome;\n\t}\n\treturn result.success ? \"success\" : \"transient_failure\";\n}\n\n/**\n * Determine whether an outcome kind is retryable. Only `transient_failure`\n * is retryable, and only when the adapter policy is idempotent. Permanent\n * failures, timeouts, and ambiguous outcomes are never retried.\n */\nexport function shouldRetryAdapterOutcome(\n\tkind: AdapterOutcomeKind,\n\tidempotent: boolean,\n): boolean {\n\treturn kind === \"transient_failure\" && idempotent;\n}\n\n/**\n * Reject a contradictory adapter result where `success` is true but the\n * explicit `outcome` is a non-success kind. A successful result claiming an\n * ambiguous, permanent, timeout, or transient outcome is a programming\n * error — the adapter cannot have both succeeded and require reconciliation.\n */\nexport function assertAdapterOutcomeConsistency(result: AdapterExecutionResult): void {\n\tif (result.success && result.outcome && result.outcome !== \"success\") {\n\t\tthrow new Error(\n\t\t\t`Adapter returned success=true with contradictory outcome \"${result.outcome}\"; a successful result must not declare a non-success outcome.`,\n\t\t);\n\t}\n}\n\n/**\n * Record an outcome on the breaker. A breaker that throws must not turn a\n * call that already ran (and may have had its external effect) into a failure.\n */\nfunction recordCircuitOutcome(\n\tbreaker: AdapterCircuitBreaker | undefined,\n\toutcome: AdapterCircuitOutcome,\n\tadmission: AdapterCircuitAdmission | undefined,\n): void {\n\tif (!breaker) return;\n\ttry {\n\t\tbreaker.record(outcome, admission);\n\t} catch {\n\t\t// Breaker bookkeeping is best effort once the call has happened.\n\t}\n}\n\nfunction circuitOpenError(\n\tbreaker: AdapterCircuitBreaker,\n\tadmission: AdapterCircuitAdmission,\n\tattempt: number,\n\tlastError: string | undefined,\n): AdapterCircuitOpenError {\n\treturn new AdapterCircuitOpenError({\n\t\tadapterKey: breaker.key,\n\t\tstate: admission.state,\n\t\tattempt,\n\t\t...(admission.retryAfterMs !== undefined ? { retryAfterMs: admission.retryAfterMs } : {}),\n\t\t...(admission.manualOverride !== undefined ? { manualOverride: admission.manualOverride } : {}),\n\t\t...(lastError !== undefined ? { lastError } : {}),\n\t});\n}\n\nexport async function executeWithAdapterRetry<T>(options: ExecuteWithRetryOptions<T>): Promise<T> {\n\tconst policy = resolveAdapterRetryPolicy(options.policy, options.defaultIdempotent);\n\tconst sleep =\n\t\toptions.sleep ?? ((delayMs) => new Promise((resolve) => setTimeout(resolve, delayMs)));\n\tconst breaker = options.circuitBreaker;\n\tlet lastError: string | undefined;\n\n\tfor (let attempt = 1; attempt <= policy.maxAttempts; attempt++) {\n\t\tlet admission: AdapterCircuitAdmission | undefined;\n\t\t// One outcome per attempt reaches the breaker, and only for an attempt\n\t\t// that reached `execute`; a later step of this iteration (onAttempt,\n\t\t// sleep) that throws into the catch below does not record a second one.\n\t\tlet executed = false;\n\t\tlet recorded = false;\n\t\tconst record = (outcome: AdapterCircuitOutcome) => {\n\t\t\tif (!executed || recorded) return;\n\t\t\trecorded = true;\n\t\t\trecordCircuitOutcome(breaker, outcome, admission);\n\t\t};\n\t\tlet refusal: AdapterCircuitAdmission | undefined;\n\t\t/**\n\t\t * Classify an error thrown by `prepareAttempt`, `execute` or a later\n\t\t * step of this attempt. Returns \"retry\" after sleeping, \"rethrow\", or the\n\t\t * breaker admission that refuses the retry.\n\t\t */\n\t\tasync function handleThrown(error: unknown): Promise<\"retry\" | \"rethrow\" | AdapterCircuitAdmission> {\n\t\t\tlastError = error instanceof Error ? error.message : String(error);\n\t\t\t// Preserve the pre-classification contract for direct callers. The\n\t\t\t// governed Host supplies a classifier and therefore remains fail-closed\n\t\t\t// for ambiguous, timeout, and permanent failures.\n\t\t\tconst thrownOutcome = options.classifyThrownError\n\t\t\t\t? options.classifyThrownError(error)\n\t\t\t\t: \"transient_failure\" as const;\n\t\t\trecord(classifyCircuitBreakerOutcome(thrownOutcome));\n\t\t\tlet willRetry =\n\t\t\t\tshouldRetryAdapterOutcome(thrownOutcome, policy.idempotent) && attempt < policy.maxAttempts;\n\t\t\tconst blocked = willRetry ? refusedRetry(breaker) : undefined;\n\t\t\tif (blocked) willRetry = false;\n\t\t\tconst nextDelayMs = willRetry ? getRetryDelayMs(attempt, policy) : undefined;\n\t\t\tawait options.onAttempt?.({ attempt, error: lastError, willRetry, nextDelayMs });\n\n\t\t\tif (blocked) return blocked;\n\t\t\tif (!willRetry) return \"rethrow\";\n\t\t\tawait sleep(nextDelayMs ?? 0);\n\t\t\treturn \"retry\";\n\t\t}\n\n\t\ttry {\n\t\t\tif (options.prepareAttempt) await options.prepareAttempt(attempt, policy.maxAttempts);\n\t\t} catch (error) {\n\t\t\tconst decision = await handleThrown(error);\n\t\t\tif (decision === \"rethrow\") throw error;\n\t\t\tif (decision === \"retry\") continue;\n\t\t\trefusal = decision;\n\t\t}\n\t\tif (!refusal) {\n\t\t\t// Admission sits immediately before the external call: no await between.\n\t\t\tif (breaker) {\n\t\t\t\tadmission = breaker.acquire();\n\t\t\t\tif (!admission.allowed) throw circuitOpenError(breaker, admission, attempt, lastError);\n\t\t\t}\n\t\t\ttry {\n\t\t\t\texecuted = true;\n\t\t\t\tconst result = await options.execute(attempt, policy.maxAttempts);\n\t\t\t\tif (options.isSuccessful(result)) {\n\t\t\t\t\trecord(\"success\");\n\t\t\t\t\tawait options.onAttempt?.({ attempt, result, willRetry: false });\n\t\t\t\t\treturn result;\n\t\t\t\t}\n\n\t\t\t\tlastError = options.getError(result) ?? \"Adapter returned unsuccessful result\";\n\t\t\t\tconst outcome = options.classifyOutcome\n\t\t\t\t\t? options.classifyOutcome(result)\n\t\t\t\t\t: \"transient_failure\" as const;\n\t\t\t\trecord(classifyCircuitBreakerOutcome(outcome));\n\t\t\t\tlet willRetry =\n\t\t\t\t\tshouldRetryAdapterOutcome(outcome, policy.idempotent) && attempt < policy.maxAttempts;\n\t\t\t\trefusal = willRetry ? refusedRetry(breaker) : undefined;\n\t\t\t\tif (refusal) willRetry = false;\n\t\t\t\tconst nextDelayMs = willRetry ? getRetryDelayMs(attempt, policy) : undefined;\n\t\t\t\tawait options.onAttempt?.({ attempt, result, error: lastError, willRetry, nextDelayMs });\n\n\t\t\t\tif (!willRetry && !refusal) {\n\t\t\t\t\treturn result;\n\t\t\t\t}\n\n\t\t\t\tif (!refusal) await sleep(nextDelayMs ?? 0);\n\t\t\t} catch (error) {\n\t\t\t\tconst decision = await handleThrown(error);\n\t\t\t\tif (decision === \"rethrow\") throw error;\n\t\t\t\trefusal = decision === \"retry\" ? undefined : decision;\n\t\t\t}\n\t\t}\n\t\t// The breaker opened on this attempt's outcome: stop instead of retrying.\n\t\tif (refusal && breaker) throw circuitOpenError(breaker, refusal, attempt + 1, lastError);\n\t}\n\n\tthrow new Error(lastError ?? \"Adapter retry exhausted\");\n}\n\n/**\n * Preview whether an `enforce`-mode breaker would refuse the next attempt.\n * Returns the refusing admission, or undefined when the retry may proceed.\n */\nfunction refusedRetry(breaker: AdapterCircuitBreaker | undefined): AdapterCircuitAdmission | undefined {\n\tif (!breaker) return undefined;\n\tconst preview = breaker.check();\n\treturn preview.allowed ? undefined : preview;\n}\n"]}

package/dist/{chunk-6QX4I45I.js → chunk-PIDZQAEL.js}

@@ -46,5 +46,5 @@ function createActionRegistry(definitions = []) {
 }
 
 export { ACTOR_TYPES, assertActionId, assertActorType, createActionRegistry, isActorType };
-//# sourceMappingURL=chunk-6QX4I45I.js.map
-//# sourceMappingURL=chunk-6QX4I45I.js.map
+//# sourceMappingURL=chunk-PIDZQAEL.js.map
+//# sourceMappingURL=chunk-PIDZQAEL.js.map

package/dist/{chunk-6QX4I45I.js.map → chunk-PIDZQAEL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";AAyBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AAmQO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAUO,SAAS,oBAAA,CAAoC,WAAA,GAAgD,EAAC,EAAwB;AAC5H,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAqC;AACzD,EAAA,MAAM,QAAA,GAAW,CAAC,UAAA,KAA4C;AAC7D,IAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,8FAAA,CAAgG,CAAA;AAAA,IAC/I;AACA,IAAA,IAAI,WAAW,eAAA,KAAoB,MAAA,IAAa,OAAO,UAAA,CAAW,oBAAoB,UAAA,EAAY;AACjG,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,kDAAA,CAAoD,CAAA;AAAA,IACnG;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,UAAA,IAAc,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA;AACzD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,UAAA,EAAY;AAC7B,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,QAAQ,CAAA,WAAY,UAAU,CAAA;AAAA,IAC3D,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAAA,IAC3C,GAAA,EAAK,CAAC,QAAA,KAAmC,OAAA,CAAQ,IAAI,QAAoB,CAAA;AAAA,IACzE,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,GACrC;AACD","file":"chunk-6QX4I45I.js","sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent signals with the same name received before another\n\t * `awaitSignal` call are buffered (FIFO) so no signal is lost.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"]}
+{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";AAyBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AA0QO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAUO,SAAS,oBAAA,CAAoC,WAAA,GAAgD,EAAC,EAAwB;AAC5H,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAqC;AACzD,EAAA,MAAM,QAAA,GAAW,CAAC,UAAA,KAA4C;AAC7D,IAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,8FAAA,CAAgG,CAAA;AAAA,IAC/I;AACA,IAAA,IAAI,WAAW,eAAA,KAAoB,MAAA,IAAa,OAAO,UAAA,CAAW,oBAAoB,UAAA,EAAY;AACjG,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,kDAAA,CAAoD,CAAA;AAAA,IACnG;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,UAAA,IAAc,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA;AACzD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,UAAA,EAAY;AAC7B,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,QAAQ,CAAA,WAAY,UAAU,CAAA;AAAA,IAC3D,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAAA,IAC3C,GAAA,EAAK,CAAC,QAAA,KAAmC,OAAA,CAAQ,IAAI,QAAoB,CAAA;AAAA,IACzE,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,GACrC;AACD","file":"chunk-PIDZQAEL.js","sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"]}

package/dist/{chunk-ATWWZTRC.js → chunk-TYNIFC7J.js}

@@ -248,21 +248,6 @@ var AnonymizationEngine = class {
   }
 };
 
-// privacy/index.ts
-var PLATFORM_PRIVACY_POLICY_VERSION = "fabric-platform-privacy-v1";
-function anonymizeJsonValue(value, context, dataClass, policy) {
-  return new AnonymizationEngine(policy).anonymizeJsonValue(value, context, dataClass);
-}
-function anonymizeAssetEventPayload(event, context, policy) {
-  return new AnonymizationEngine(policy).anonymizeAssetEventPayload(event, context);
-}
-function anonymizeEvidencePacket(packet, context, policy) {
-  return new AnonymizationEngine(policy).anonymizeEvidencePacket(packet, context);
-}
-function buildAnonymizationLifecycleEvidence(input, policy) {
-  return new AnonymizationEngine(policy).buildAnonymizationLifecycleEvidence(input);
-}
-
-export { ANONYMIZATION_POLICY_VERSION, AnonymizationEngine, FieldRedactor, PLATFORM_PRIVACY_POLICY_VERSION, anonymizeAssetEventPayload, anonymizeEvidencePacket, anonymizeJsonValue, buildAnonymizationLifecycleEvidence, stableChecksum };
-//# sourceMappingURL=chunk-ATWWZTRC.js.map
-//# sourceMappingURL=chunk-ATWWZTRC.js.map
+export { ANONYMIZATION_POLICY_VERSION, AnonymizationEngine, FieldRedactor, stableChecksum };
+//# sourceMappingURL=chunk-TYNIFC7J.js.map
+//# sourceMappingURL=chunk-TYNIFC7J.js.map

package/dist/chunk-TYNIFC7J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../privacy/engine.ts"],"names":[],"mappings":";;;AAWO,IAAM,4BAAA,GAA+B;AAgE5C,SAAS,aAAa,GAAA,EAAqB;AAC1C,EAAA,OAAO,GAAA,CAAI,OAAA,CAAQ,eAAA,EAAiB,EAAE,EAAE,WAAA,EAAY;AACrD;AAEO,SAAS,eAAe,KAAA,EAAwB;AACtD,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,IAAA,CAAK,UAAU,KAAK,CAAC,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AACvE;AAEA,SAAS,iBAAA,CACR,KAAA,EACA,OAAA,EACA,SAAA,EACS;AACT,EAAA,MAAM,KAAA,GAAQ,GAAG,OAAA,CAAQ,QAAQ,IAAI,OAAA,CAAQ,OAAA,IAAW,QAAQ,CAAA,CAAA,EAAI,SAAS,CAAA,CAAA;AAC7E,EAAA,OAAO,CAAA,IAAA,EAAO,WAAW,QAAQ,CAAA,CAC/B,OAAO,CAAA,EAAG,OAAA,CAAQ,aAAA,IAAiB,4BAA4B,CAAA,CAAA,EAAI,KAAK,IAAI,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA,CAC3F,MAAA,CAAO,KAAK,CAAA,CACZ,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,CAAA;AACf;AAEA,SAAS,UAAU,KAAA,EAA+B;AACjD,EAAA,IAAI,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AAC1C,IAAA,OAAO,IAAA;AAAA,EACR;AAEA,EAAA,MAAM,WAAA,GAAc,OAAO,KAAK,CAAA;AAChC,EAAA,IAAI,WAAA,CAAY,UAAU,CAAA,EAAG;AAC5B,IAAA,OAAO,MAAA;AAAA,EACR;AAEA,EAAA,OAAO,CAAA,EAAG,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,IAAI,WAAA,CAAY,MAAA,GAAS,CAAA,EAAG,CAAC,CAAC,CAAC,CAAA,EAAG,WAAA,CAAY,KAAA,CAAM,EAAE,CAAC,CAAA,CAAA;AAClF;AAEA,SAAS,gBAAgB,KAAA,EAAyB;AACjD,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC9B,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,GAAI,CAAA,GAAI,GAAA;AAAA,EACnC;AAEA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,oBAAA,CAAqB,IAAA,CAAK,KAAK,CAAA,EAAG;AAClE,IAAA,OAAO,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,EAAA,CAAA;AAAA,EAC5B;AAEA,EAAA,OAAO,IAAA;AACR;AAEA,SAAS,WAAA,CACR,KAAA,EACA,MAAA,EACA,OAAA,EACA,IAAA,EACU;AACV,EAAA,QAAQ,MAAA;AAAQ,IACf,KAAK,MAAA;AACJ,MAAA,OAAO,MAAA;AAAA,IACR,KAAK,SAAA;AACJ,MAAA,OAAO,IAAA;AAAA,IACR,KAAK,MAAA;AACJ,MAAA,OAAO,UAAU,KAAK,CAAA;AAAA,IACvB,KAAK,MAAA;AACJ,MAAA,OAAO,CAAA,OAAA,EAAU,cAAA,CAAe,KAAK,CAAC,CAAA,CAAA;AAAA,IACvC,KAAK,UAAA;AACJ,MAAA,OAAO,iBAAA,CAAkB,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA;AAAA,IAC9C,KAAK,YAAA;AACJ,MAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA;AAE/B;AAEA,SAAS,aAAA,CAAc,QAAA,EAA+C,IAAA,EAAc,GAAA,EAAoD;AACvI,EAAA,MAAM,cAAA,GAAiB,aAAa,IAAI,CAAA;AACxC,EAAA,MAAM,aAAA,GAAgB,GAAA,GAAM,YAAA,CAAa,GAAG,CAAA,GAAI,MAAA;AAEhD,EAAA,OAAO,QAAA,CAAS,IAAA,CAAK,CAAC,MAAA,KAAW;AAChC,IAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,MAAA,CAAO,KAAK,CAAA;AACjD,IAAA,IAAI,MAAA,CAAO,UAAU,KAAA,EAAO;AAC3B,MAAA,OAAO,eAAA,KAAoB,aAAA;AAAA,IAC5B;AAEA,IAAA,OAAO,eAAA,KAAoB,cAAA;AAAA,EAC5B,CAAC,CAAA;AACF;AAEA,SAAS,cAAc,KAAA,EAAqC;AAC3D,EAAA,OACC,OAAA,CAAQ,KAAK,CAAA,IAAK,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,EAAE,KAAA,YAAiB,IAAA,CAAA;AAE7F;AAEA,SAAS,mBACR,KAAA,EACA,OAAA,EACA,WACA,IAAA,EACA,cAAA,EACA,UACA,GAAA,EACU;AACV,EAAA,MAAM,WAAA,GAAc,aAAA,CAAc,QAAA,EAAU,IAAA,EAAM,GAAG,CAAA;AACrD,EAAA,IAAI,WAAA,IAAe,KAAA,KAAU,IAAA,IAAQ,KAAA,KAAU,MAAA,EAAW;AACzD,IAAA,cAAA,CAAe,IAAA,CAAK;AAAA,MACnB,SAAA,EAAW,IAAA;AAAA,MACX,QAAQ,WAAA,CAAY,MAAA;AAAA,MACpB,aAAA,EAAe,QAAQ,aAAA,IAAiB,4BAAA;AAAA,MACxC,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,aAAa,OAAA,CAAQ,UAAA,oBAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,MAC3D,QAAQ,OAAA,CAAQ,MAAA;AAAA,MAChB,SAAA;AAAA,MACA,cAAA,EAAgB,eAAe,KAAK;AAAA,KACpC,CAAA;AAED,IAAA,OAAO,WAAA,CAAY,KAAA,EAAO,WAAA,CAAY,MAAA,EAAQ,SAAS,IAAI,CAAA;AAAA,EAC5D;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO,KAAA,CAAM,GAAA;AAAA,MAAI,CAAC,IAAA,EAAM,KAAA,KACvB,kBAAA,CAAmB,IAAA,EAAM,OAAA,EAAS,SAAA,EAAW,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA,CAAA,EAAK,gBAAgB,QAAQ;AAAA,KAC3F;AAAA,EACD;AAEA,EAAA,IAAI,CAAC,aAAA,CAAc,KAAK,CAAA,EAAG;AAC1B,IAAA,OAAO,KAAA;AAAA,EACR;AAEA,EAAA,MAAM,SAAqB,EAAC;AAC5B,EAAA,KAAA,MAAW,CAAC,QAAA,EAAU,UAAU,KAAK,MAAA,CAAO,OAAA,CAAQ,KAAK,CAAA,EAAG;AAC3D,IAAA,IAAI,aAAa,UAAA,EAAY;AAC5B,MAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,UAAA;AACnB,MAAA;AAAA,IACD;AAEA,IAAA,MAAM,UAAA,GAAa,kBAAA;AAAA,MAClB,UAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,QAAQ,CAAA,CAAA;AAAA,MACnB,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACD;AAEA,IAAA,IAAI,eAAe,MAAA,EAAW;AAC7B,MAAA,MAAA,CAAO,QAAQ,CAAA,GAAI,UAAA;AAAA,IACpB;AAAA,EACD;AAEA,EAAA,OAAO,MAAA;AACR;AAEA,SAAS,aAAA,CACR,OAAA,EACA,SAAA,EACA,cAAA,EACA,kBAAA,EACwB;AACxB,EAAA,OAAO;AAAA,IACN,cAAA,EAAgB,YAAA;AAAA,IAChB,aAAA,EAAe,QAAQ,aAAA,IAAiB,4BAAA;AAAA,IACxC,OAAO,OAAA,CAAQ,KAAA;AAAA,IACf,aAAa,OAAA,CAAQ,UAAA,oBAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,IAC3D,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,SAAA;AAAA,IACA,cAAA;AAAA,IACA,kBAAA,EAAoB,CAAC,GAAG,kBAAkB;AAAA,GAC3C;AACD;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAC1B,WAAA,CAAY,KAAA,EAAgB,MAAA,EAAyB,OAAA,EAA+B,IAAA,EAAuB;AAC1G,IAAA,OAAO,WAAA,CAAY,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS,IAAI,CAAA;AAAA,EAChD;AAAA,EAEA,KAAK,KAAA,EAA+B;AACnC,IAAA,OAAO,UAAU,KAAK,CAAA;AAAA,EACvB;AAAA,EAEA,KAAK,KAAA,EAAwB;AAC5B,IAAA,OAAO,CAAA,OAAA,EAAU,cAAA,CAAe,KAAK,CAAC,CAAA,CAAA;AAAA,EACvC;AAAA,EAEA,QAAA,CAAS,KAAA,EAAgB,OAAA,EAA+B,IAAA,EAAsB;AAC7E,IAAA,OAAO,iBAAA,CAAkB,KAAA,EAAO,OAAA,EAAS,IAAI,CAAA;AAAA,EAC9C;AAAA,EAEA,WAAW,KAAA,EAAyB;AACnC,IAAA,OAAO,gBAAgB,KAAK,CAAA;AAAA,EAC7B;AACD;AAEO,IAAM,sBAAN,MAA0B;AAAA,EACvB,OAAA;AAAA,EAET,YAAY,MAAA,EAA6B;AACxC,IAAA,IAAA,CAAK,OAAA,GAAU;AAAA,MACd,MAAA,EAAQ,OAAO,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,MAAW,EAAE,GAAG,KAAA,EAAM,CAAE,CAAA;AAAA,MACnD,oBAAoB,CAAC,GAAI,MAAA,CAAO,kBAAA,IAAsB,EAAG;AAAA,KAC1D;AAAA,EACD;AAAA,EAEA,kBAAA,CACC,KAAA,EACA,OAAA,EACA,SAAA,EAC8B;AAC9B,IAAA,OAAO,IAAA,CAAK,wBAAA,CAAyB,KAAA,EAAO,OAAA,EAAS,WAAW,GAAG,CAAA;AAAA,EACpE;AAAA,EAEA,wBAAA,CACC,KAAA,EACA,OAAA,EACA,SAAA,EACA,QAAA,EAC8B;AAC9B,IAAA,MAAM,iBAA+C,EAAC;AACtD,IAAA,MAAM,eAAA,GAAkB,kBAAA;AAAA,MACvB,KAAA;AAAA,MACA,OAAA;AAAA,MACA,SAAA;AAAA,MACA,QAAA;AAAA,MACA,cAAA;AAAA,MACA,KAAK,OAAA,CAAQ;AAAA,KACd;AAEA,IAAA,OAAO;AAAA,MACN,KAAA,EAAO,eAAA;AAAA,MACP,QAAA,EAAU,cAAc,OAAA,EAAS,SAAA,EAAW,gBAAgB,IAAA,CAAK,OAAA,CAAQ,kBAAA,IAAsB,EAAE;AAAA,KAClG;AAAA,EACD;AAAA,EAEA,0BAAA,CACC,OACA,OAAA,EAC+B;AAC/B,IAAA,MAAM,SAAS,IAAA,CAAK,kBAAA,CAAmB,KAAA,CAAM,OAAA,EAAS,SAAS,aAAa,CAAA;AAC5E,IAAA,MAAM,UAAU,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA,GACvC,EAAE,GAAG,MAAA,CAAO,KAAA,EAAO,UAAU,MAAA,CAAO,QAAA,KACpC,EAAE,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,OAAO,QAAA,EAAS;AAEpD,IAAA,OAAO,EAAE,KAAA,EAAO,OAAA,EAAS,QAAA,EAAU,OAAO,QAAA,EAAS;AAAA,EACpD;AAAA,EAEA,uBAAA,CACC,QACA,OAAA,EAC6F;AAC7F,IAAA,MAAM,SAAS,IAAA,CAAK,kBAAA,CAAmB,MAAA,CAAO,MAAA,EAAQ,SAAS,iBAAiB,CAAA;AAChF,IAAA,MAAM,iBAAA,GAAoB;AAAA,MACzB,GAAI,aAAA,CAAc,MAAA,CAAO,iBAAiB,CAAA,GAAI,MAAA,CAAO,oBAAoB,EAAC;AAAA,MAC1E,wBAAwB,MAAA,CAAO;AAAA,KAChC;AACA,IAAA,MAAM,mBAAmB,aAAA,CAAc,MAAA,CAAO,KAAK,CAAA,GAChD,EAAE,GAAG,MAAA,CAAO,KAAA,EAAO,UAAU,MAAA,CAAO,QAAA,KACpC,EAAE,KAAA,EAAO,OAAO,KAAA,EAAO,QAAA,EAAU,OAAO,QAAA,EAAS;AAEpD,IAAA,OAAO;AAAA,MACN,KAAA,EAAO;AAAA,QACN,MAAA,EAAQ,gBAAA;AAAA,QACR,iBAAA;AAAA,QACA,UAAU,cAAA,CAAe,EAAE,MAAA,EAAQ,gBAAA,EAAkB,mBAAmB;AAAA,OACzE;AAAA,MACA,UAAU,MAAA,CAAO;AAAA,KAClB;AAAA,EACD;AAAA,EAEA,oCAAoC,KAAA,EASD;AAClC,IAAA,MAAM,WAAA,GAAc,KAAA,CAAM,WAAA,IAAe,EAAC;AAC1C,IAAA,MAAM,UAAA,GAAa,KAAA,CAAM,UAAA,IAAc,EAAC;AACxC,IAAA,MAAM,eAAA,GAAkB,KAAA,CAAM,eAAA,IAAmB,EAAC;AAClD,IAAA,MAAM,cAAA,GAAiB;AAAA,MACtB,GAAG,WAAA,CAAY,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc,CAAA;AAAA,MAC7D,GAAG,UAAA,CAAW,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc,CAAA;AAAA,MAC5D,GAAG,eAAA,CAAgB,OAAA,CAAQ,CAAC,IAAA,KAAS,IAAA,CAAK,SAAS,cAAc;AAAA,KAClE;AAEA,IAAA,OAAO;AAAA,MACN,SAAA,EAAW,sBAAA;AAAA,MACX,aAAA,EAAe,KAAA,CAAM,OAAA,CAAQ,aAAA,IAAiB,4BAAA;AAAA,MAC9C,KAAA,EAAO,MAAM,OAAA,CAAQ,KAAA;AAAA,MACrB,MAAA,EAAQ,MAAM,OAAA,CAAQ,MAAA;AAAA,MACtB,YAAY,KAAA,CAAM,OAAA,CAAQ,8BAAc,IAAI,IAAA,IAAQ,WAAA,EAAY;AAAA,MAChE,QAAA,EAAU,MAAM,OAAA,CAAQ,QAAA;AAAA,MACxB,OAAA,EAAS,KAAA,CAAM,OAAA,CAAQ,OAAA,IAAW,IAAA;AAAA,MAClC,MAAA,EAAQ;AAAA,QACP,aAAa,WAAA,CAAY,MAAA;AAAA,QACzB,YAAY,UAAA,CAAW,MAAA;AAAA,QACvB,iBAAiB,eAAA,CAAgB,MAAA;AAAA,QACjC,gBAAgB,cAAA,CAAe;AAAA,OAChC;AAAA,MACA,OAAA,EAAS;AAAA,QACR,GAAG,WAAA,CAAY,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UAC7B,WAAA,EAAa,aAAA;AAAA,UACb,QAAA,EAAU,KAAK,KAAA,CAAM,EAAA;AAAA,UACrB,WAAA,EAAa,KAAK,KAAA,CAAM,WAAA;AAAA,UACxB,SAAA,EAAW,KAAK,KAAA,CAAM,SAAA;AAAA,UACtB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE,CAAA;AAAA,QACF,GAAG,UAAA,CAAW,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UAC5B,WAAA,EAAa,YAAA;AAAA,UACb,QAAA,EAAU,KAAK,MAAA,CAAO,EAAA;AAAA,UACtB,aAAa,IAAA,CAAK,SAAA;AAAA,UAClB,SAAA,EAAW,KAAK,MAAA,CAAO,EAAA;AAAA,UACvB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE,CAAA;AAAA,QACF,GAAG,eAAA,CAAgB,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,UACjC,WAAA,EAAa,iBAAA;AAAA,UACb,QAAA,EAAU,KAAK,MAAA,CAAO,EAAA;AAAA,UACtB,aAAA,EAAe,IAAA,CAAK,QAAA,CAAS,cAAA,CAAe,GAAA;AAAA,YAC3C,CAAC,EAAE,SAAA,EAAW,MAAA,EAAQ,gBAAe,MAAO;AAAA,cAC3C,SAAA;AAAA,cACA,MAAA;AAAA,cACA;AAAA,aACD;AAAA;AACD,SACD,CAAE;AAAA,OACH;AAAA,MACA,oBAAoB,CAAC,GAAI,KAAK,OAAA,CAAQ,kBAAA,IAAsB,EAAG;AAAA,KAChE;AAAA,EACD;AACD","file":"chunk-TYNIFC7J.js","sourcesContent":["import { createHash } from \"node:crypto\";\n\nimport type {\n\tAnonymizationContext,\n\tAnonymizationFieldMetadata,\n\tAnonymizationMetadata,\n\tAnonymizationResult,\n\tPlatformDataClass,\n\tRedactionMethod,\n} from \"./index\";\n\nexport const ANONYMIZATION_POLICY_VERSION = \"adr-026-platform-anonymization-v1\";\n\ntype JsonObject = Record<string, unknown>;\n\nexport interface AnonymizationFieldPolicy {\n\tmethod: RedactionMethod;\n\tmatch: \"key\" | \"path\";\n\tvalue: string;\n}\n\nexport interface AnonymizationPolicy {\n\tfields: readonly AnonymizationFieldPolicy[];\n\tpreservedSemantics?: readonly string[];\n}\n\nexport interface AssetEventLike {\n\tid: string;\n\ttenantId: string;\n\tspaceId: string;\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tactionInvocationId: string;\n\tpayload: unknown;\n\tsequence: number;\n\toccurredAt: Date;\n\trecordedAt: Date;\n\tcorrelationId: string;\n\tcausationId?: string | null;\n}\n\nexport interface EvidencePacketLike {\n\tid: string;\n\tpacket: unknown;\n\tredactionMetadata: unknown;\n\tchecksum: string;\n}\n\nexport interface AnonymizationLifecycleEvidence {\n\teventType: \"AnonymizationApplied\";\n\tpolicyVersion: string;\n\tjobId: string;\n\treason: string;\n\tappliedAt: string;\n\ttenantId: string;\n\tspaceId: string | null;\n\tcounts: {\n\t\tassetEvents: number;\n\t\treadModels: number;\n\t\tevidencePackets: number;\n\t\tredactedFields: number;\n\t};\n\trecords: Array<{\n\t\trecordClass: PlatformDataClass;\n\t\trecordId: string;\n\t\tsubjectType?: string;\n\t\tsubjectId?: string;\n\t\tfieldManifest: Array<\n\t\t\tPick<AnonymizationFieldMetadata, \"fieldPath\" | \"method\" | \"beforeChecksum\">\n\t\t>;\n\t}>;\n\tpreservedSemantics: string[];\n}\n\nfunction normalizeKey(key: string): string {\n\treturn key.replace(/[^a-zA-Z0-9]/g, \"\").toLowerCase();\n}\n\nexport function stableChecksum(value: unknown): string {\n\treturn createHash(\"sha256\").update(JSON.stringify(value)).digest(\"hex\");\n}\n\nfunction stableScopedToken(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tfieldPath: string,\n): string {\n\tconst scope = `${context.tenantId}:${context.spaceId ?? \"global\"}:${fieldPath}`;\n\treturn `tok_${createHash(\"sha256\")\n\t\t.update(`${context.policyVersion ?? ANONYMIZATION_POLICY_VERSION}:${scope}:${String(value)}`)\n\t\t.digest(\"hex\")\n\t\t.slice(0, 24)}`;\n}\n\nfunction maskValue(value: unknown): string | null {\n\tif (value === null || value === undefined) {\n\t\treturn null;\n\t}\n\n\tconst stringValue = String(value);\n\tif (stringValue.length <= 4) {\n\t\treturn \"****\";\n\t}\n\n\treturn `${\"*\".repeat(Math.max(stringValue.length - 4, 4))}${stringValue.slice(-4)}`;\n}\n\nfunction generalizeValue(value: unknown): unknown {\n\tif (typeof value === \"number\") {\n\t\treturn Math.round(value / 1000) * 1000;\n\t}\n\n\tif (typeof value === \"string\" && /^\\d{5}(?:-\\d{4})?$/.test(value)) {\n\t\treturn `${value.slice(0, 3)}**`;\n\t}\n\n\treturn null;\n}\n\nfunction applyMethod(\n\tvalue: unknown,\n\tmethod: RedactionMethod,\n\tcontext: AnonymizationContext,\n\tpath: string,\n): unknown {\n\tswitch (method) {\n\t\tcase \"drop\":\n\t\t\treturn undefined;\n\t\tcase \"nullify\":\n\t\t\treturn null;\n\t\tcase \"mask\":\n\t\t\treturn maskValue(value);\n\t\tcase \"hash\":\n\t\t\treturn `sha256_${stableChecksum(value)}`;\n\t\tcase \"tokenize\":\n\t\t\treturn stableScopedToken(value, context, path);\n\t\tcase \"generalize\":\n\t\t\treturn generalizeValue(value);\n\t}\n}\n\nfunction policyForPath(policies: readonly AnonymizationFieldPolicy[], path: string, key?: string): AnonymizationFieldPolicy | undefined {\n\tconst normalizedPath = normalizeKey(path);\n\tconst normalizedKey = key ? normalizeKey(key) : undefined;\n\n\treturn policies.find((policy) => {\n\t\tconst normalizedValue = normalizeKey(policy.value);\n\t\tif (policy.match === \"key\") {\n\t\t\treturn normalizedValue === normalizedKey;\n\t\t}\n\n\t\treturn normalizedValue === normalizedPath;\n\t});\n}\n\nfunction isPlainObject(value: unknown): value is JsonObject {\n\treturn (\n\t\tBoolean(value) && typeof value === \"object\" && !Array.isArray(value) && !(value instanceof Date)\n\t);\n}\n\nfunction anonymizeRecursive(\n\tvalue: unknown,\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tpath: string,\n\tredactedFields: AnonymizationFieldMetadata[],\n\tpolicies: readonly AnonymizationFieldPolicy[],\n\tkey?: string,\n): unknown {\n\tconst fieldPolicy = policyForPath(policies, path, key);\n\tif (fieldPolicy && value !== null && value !== undefined) {\n\t\tredactedFields.push({\n\t\t\tfieldPath: path,\n\t\t\tmethod: fieldPolicy.method,\n\t\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: context.jobId,\n\t\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\t\treason: context.reason,\n\t\t\tdataClass,\n\t\t\tbeforeChecksum: stableChecksum(value),\n\t\t});\n\n\t\treturn applyMethod(value, fieldPolicy.method, context, path);\n\t}\n\n\tif (Array.isArray(value)) {\n\t\treturn value.map((item, index) =>\n\t\t\tanonymizeRecursive(item, context, dataClass, `${path}[${index}]`, redactedFields, policies),\n\t\t);\n\t}\n\n\tif (!isPlainObject(value)) {\n\t\treturn value;\n\t}\n\n\tconst result: JsonObject = {};\n\tfor (const [childKey, childValue] of Object.entries(value)) {\n\t\tif (childKey === \"_privacy\") {\n\t\t\tresult[childKey] = childValue;\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst anonymized = anonymizeRecursive(\n\t\t\tchildValue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\t`${path}.${childKey}`,\n\t\t\tredactedFields,\n\t\t\tpolicies,\n\t\t\tchildKey,\n\t\t);\n\n\t\tif (anonymized !== undefined) {\n\t\t\tresult[childKey] = anonymized;\n\t\t}\n\t}\n\n\treturn result;\n}\n\nfunction buildMetadata(\n\tcontext: AnonymizationContext,\n\tdataClass: PlatformDataClass,\n\tredactedFields: AnonymizationFieldMetadata[],\n\tpreservedSemantics: readonly string[],\n): AnonymizationMetadata {\n\treturn {\n\t\tredactionState: \"anonymized\",\n\t\tpolicyVersion: context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\tjobId: context.jobId,\n\t\tredactedAt: (context.redactedAt ?? new Date()).toISOString(),\n\t\treason: context.reason,\n\t\tdataClass,\n\t\tredactedFields,\n\t\tpreservedSemantics: [...preservedSemantics],\n\t};\n}\n\nexport class FieldRedactor {\n\tredactField(value: unknown, method: RedactionMethod, context: AnonymizationContext, path: string): unknown {\n\t\treturn applyMethod(value, method, context, path);\n\t}\n\n\tmask(value: unknown): string | null {\n\t\treturn maskValue(value);\n\t}\n\n\thash(value: unknown): string {\n\t\treturn `sha256_${stableChecksum(value)}`;\n\t}\n\n\ttokenize(value: unknown, context: AnonymizationContext, path: string): string {\n\t\treturn stableScopedToken(value, context, path);\n\t}\n\n\tgeneralize(value: unknown): unknown {\n\t\treturn generalizeValue(value);\n\t}\n}\n\nexport class AnonymizationEngine {\n\treadonly #policy: AnonymizationPolicy;\n\n\tconstructor(policy: AnonymizationPolicy) {\n\t\tthis.#policy = {\n\t\t\tfields: policy.fields.map((field) => ({ ...field })),\n\t\t\tpreservedSemantics: [...(policy.preservedSemantics ?? [])],\n\t\t};\n\t}\n\n\tanonymizeJsonValue<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t): AnonymizationResult<TValue> {\n\t\treturn this.anonymizeJsonValueAtPath(value, context, dataClass, \"$\");\n\t}\n\n\tanonymizeJsonValueAtPath<TValue>(\n\t\tvalue: TValue,\n\t\tcontext: AnonymizationContext,\n\t\tdataClass: PlatformDataClass,\n\t\tbasePath: string,\n\t): AnonymizationResult<TValue> {\n\t\tconst redactedFields: AnonymizationFieldMetadata[] = [];\n\t\tconst anonymizedValue = anonymizeRecursive(\n\t\t\tvalue,\n\t\t\tcontext,\n\t\t\tdataClass,\n\t\t\tbasePath,\n\t\t\tredactedFields,\n\t\t\tthis.#policy.fields,\n\t\t) as TValue;\n\n\t\treturn {\n\t\t\tvalue: anonymizedValue,\n\t\t\tmetadata: buildMetadata(context, dataClass, redactedFields, this.#policy.preservedSemantics ?? []),\n\t\t};\n\t}\n\n\tanonymizeAssetEventPayload(\n\t\tevent: AssetEventLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<unknown> {\n\t\tconst result = this.anonymizeJsonValue(event.payload, context, \"asset_event\");\n\t\tconst payload = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn { value: payload, metadata: result.metadata };\n\t}\n\n\tanonymizeEvidencePacket(\n\t\tpacket: EvidencePacketLike,\n\t\tcontext: AnonymizationContext,\n\t): AnonymizationResult<Pick<EvidencePacketLike, \"packet\" | \"redactionMetadata\" | \"checksum\">> {\n\t\tconst result = this.anonymizeJsonValue(packet.packet, context, \"evidence_packet\");\n\t\tconst redactionMetadata = {\n\t\t\t...(isPlainObject(packet.redactionMetadata) ? packet.redactionMetadata : {}),\n\t\t\tlifecycleAnonymization: result.metadata,\n\t\t};\n\t\tconst anonymizedPacket = isPlainObject(result.value)\n\t\t\t? { ...result.value, _privacy: result.metadata }\n\t\t\t: { value: result.value, _privacy: result.metadata };\n\n\t\treturn {\n\t\t\tvalue: {\n\t\t\t\tpacket: anonymizedPacket,\n\t\t\t\tredactionMetadata,\n\t\t\t\tchecksum: stableChecksum({ packet: anonymizedPacket, redactionMetadata }),\n\t\t\t},\n\t\t\tmetadata: result.metadata,\n\t\t};\n\t}\n\n\tbuildAnonymizationLifecycleEvidence(input: {\n\t\tcontext: AnonymizationContext;\n\t\tassetEvents?: Array<{ event: AssetEventLike; metadata: AnonymizationMetadata }>;\n\t\treadModels?: Array<{\n\t\t\tmodelKind: string;\n\t\t\trecord: JsonObject & { id: string };\n\t\t\tmetadata: AnonymizationMetadata;\n\t\t}>;\n\t\tevidencePackets?: Array<{ packet: EvidencePacketLike; metadata: AnonymizationMetadata }>;\n\t}): AnonymizationLifecycleEvidence {\n\t\tconst assetEvents = input.assetEvents ?? [];\n\t\tconst readModels = input.readModels ?? [];\n\t\tconst evidencePackets = input.evidencePackets ?? [];\n\t\tconst redactedFields = [\n\t\t\t...assetEvents.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...readModels.flatMap((item) => item.metadata.redactedFields),\n\t\t\t...evidencePackets.flatMap((item) => item.metadata.redactedFields),\n\t\t];\n\n\t\treturn {\n\t\t\teventType: \"AnonymizationApplied\",\n\t\t\tpolicyVersion: input.context.policyVersion ?? ANONYMIZATION_POLICY_VERSION,\n\t\t\tjobId: input.context.jobId,\n\t\t\treason: input.context.reason,\n\t\t\tappliedAt: (input.context.redactedAt ?? new Date()).toISOString(),\n\t\t\ttenantId: input.context.tenantId,\n\t\t\tspaceId: input.context.spaceId ?? null,\n\t\t\tcounts: {\n\t\t\t\tassetEvents: assetEvents.length,\n\t\t\t\treadModels: readModels.length,\n\t\t\t\tevidencePackets: evidencePackets.length,\n\t\t\t\tredactedFields: redactedFields.length,\n\t\t\t},\n\t\t\trecords: [\n\t\t\t\t...assetEvents.map((item) => ({\n\t\t\t\t\trecordClass: \"asset_event\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.event.id,\n\t\t\t\t\tsubjectType: item.event.subjectType,\n\t\t\t\t\tsubjectId: item.event.subjectId,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...readModels.map((item) => ({\n\t\t\t\t\trecordClass: \"read_model\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.record.id,\n\t\t\t\t\tsubjectType: item.modelKind,\n\t\t\t\t\tsubjectId: item.record.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t\t...evidencePackets.map((item) => ({\n\t\t\t\t\trecordClass: \"evidence_packet\" as PlatformDataClass,\n\t\t\t\t\trecordId: item.packet.id,\n\t\t\t\t\tfieldManifest: item.metadata.redactedFields.map(\n\t\t\t\t\t\t({ fieldPath, method, beforeChecksum }) => ({\n\t\t\t\t\t\t\tfieldPath,\n\t\t\t\t\t\t\tmethod,\n\t\t\t\t\t\t\tbeforeChecksum,\n\t\t\t\t\t\t}),\n\t\t\t\t\t),\n\t\t\t\t})),\n\t\t\t],\n\t\t\tpreservedSemantics: [...(this.#policy.preservedSemantics ?? [])],\n\t\t};\n\t}\n}\n"]}

package/dist/{chunk-XCAOO6KG.cjs → chunk-UGWGHTNC.cjs}

@@ -52,5 +52,5 @@ exports.assertActionId = assertActionId;
 exports.assertActorType = assertActorType;
 exports.createActionRegistry = createActionRegistry;
 exports.isActorType = isActorType;
-//# sourceMappingURL=chunk-XCAOO6KG.cjs.map
-//# sourceMappingURL=chunk-XCAOO6KG.cjs.map
+//# sourceMappingURL=chunk-UGWGHTNC.cjs.map
+//# sourceMappingURL=chunk-UGWGHTNC.cjs.map

package/dist/{chunk-XCAOO6KG.cjs.map → chunk-UGWGHTNC.cjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";;;AAyBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AAmQO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAUO,SAAS,oBAAA,CAAoC,WAAA,GAAgD,EAAC,EAAwB;AAC5H,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAqC;AACzD,EAAA,MAAM,QAAA,GAAW,CAAC,UAAA,KAA4C;AAC7D,IAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,8FAAA,CAAgG,CAAA;AAAA,IAC/I;AACA,IAAA,IAAI,WAAW,eAAA,KAAoB,MAAA,IAAa,OAAO,UAAA,CAAW,oBAAoB,UAAA,EAAY;AACjG,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,kDAAA,CAAoD,CAAA;AAAA,IACnG;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,UAAA,IAAc,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA;AACzD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,UAAA,EAAY;AAC7B,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,QAAQ,CAAA,WAAY,UAAU,CAAA;AAAA,IAC3D,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAAA,IAC3C,GAAA,EAAK,CAAC,QAAA,KAAmC,OAAA,CAAQ,IAAI,QAAoB,CAAA;AAAA,IACzE,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,GACrC;AACD","file":"chunk-XCAOO6KG.cjs","sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent signals with the same name received before another\n\t * `awaitSignal` call are buffered (FIFO) so no signal is lost.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"]}
+{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";;;AAyBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AA0QO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAUO,SAAS,oBAAA,CAAoC,WAAA,GAAgD,EAAC,EAAwB;AAC5H,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAqC;AACzD,EAAA,MAAM,QAAA,GAAW,CAAC,UAAA,KAA4C;AAC7D,IAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,8FAAA,CAAgG,CAAA;AAAA,IAC/I;AACA,IAAA,IAAI,WAAW,eAAA,KAAoB,MAAA,IAAa,OAAO,UAAA,CAAW,oBAAoB,UAAA,EAAY;AACjG,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,kDAAA,CAAoD,CAAA;AAAA,IACnG;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,UAAA,IAAc,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA;AACzD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,UAAA,EAAY;AAC7B,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,QAAQ,CAAA,WAAY,UAAU,CAAA;AAAA,IAC3D,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAAA,IAC3C,GAAA,EAAK,CAAC,QAAA,KAAmC,OAAA,CAAQ,IAAI,QAAoB,CAAA;AAAA,IACzE,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,GACrC;AACD","file":"chunk-UGWGHTNC.cjs","sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"]}

package/dist/evidence/index.cjs

@@ -1,6 +1,50 @@
 'use strict';
 
-require('../chunk-PG5LYTUX.cjs');
+var chunk6HY35TKB_cjs = require('../chunk-6HY35TKB.cjs');
+require('../chunk-LZSE6QGQ.cjs');
+require('../chunk-CRZXTZ36.cjs');
 
+
+
+Object.defineProperty(exports, "DEFAULT_EVIDENCE_PACKET_TYPE", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.DEFAULT_EVIDENCE_PACKET_TYPE; }
+});
+Object.defineProperty(exports, "DEFAULT_EVIDENCE_REDACTION_REASON", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.DEFAULT_EVIDENCE_REDACTION_REASON; }
+});
+Object.defineProperty(exports, "EVIDENCE_PACKET_CHECKSUM_ALGORITHM", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.EVIDENCE_PACKET_CHECKSUM_ALGORITHM; }
+});
+Object.defineProperty(exports, "EVIDENCE_PACKET_SCHEMA_VERSION", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.EVIDENCE_PACKET_SCHEMA_VERSION; }
+});
+Object.defineProperty(exports, "EvidencePacketGenerationError", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.EvidencePacketGenerationError; }
+});
+Object.defineProperty(exports, "canonicalJson", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.canonicalJson; }
+});
+Object.defineProperty(exports, "computeEvidencePacketChecksum", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.computeEvidencePacketChecksum; }
+});
+Object.defineProperty(exports, "createEvidencePacketRenderer", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.createEvidencePacketRenderer; }
+});
+Object.defineProperty(exports, "generateEvidencePacket", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.generateEvidencePacket; }
+});
+Object.defineProperty(exports, "verifyEvidencePacketChecksum", {
+  enumerable: true,
+  get: function () { return chunk6HY35TKB_cjs.verifyEvidencePacketChecksum; }
+});
 //# sourceMappingURL=index.cjs.map
 //# sourceMappingURL=index.cjs.map