@fabricorg/platform 1.7.0 → 1.9.0

package/dist/{chunk-6QX4I45I.js → chunk-PIDZQAEL.js}

@@ -46,5 +46,5 @@ function createActionRegistry(definitions = []) {
 }
 
 export { ACTOR_TYPES, assertActionId, assertActorType, createActionRegistry, isActorType };
-//# sourceMappingURL=chunk-6QX4I45I.js.map
-//# sourceMappingURL=chunk-6QX4I45I.js.map
+//# sourceMappingURL=chunk-PIDZQAEL.js.map
+//# sourceMappingURL=chunk-PIDZQAEL.js.map

package/dist/{chunk-6QX4I45I.js.map → chunk-PIDZQAEL.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";AAyBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AAmQO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAUO,SAAS,oBAAA,CAAoC,WAAA,GAAgD,EAAC,EAAwB;AAC5H,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAqC;AACzD,EAAA,MAAM,QAAA,GAAW,CAAC,UAAA,KAA4C;AAC7D,IAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,8FAAA,CAAgG,CAAA;AAAA,IAC/I;AACA,IAAA,IAAI,WAAW,eAAA,KAAoB,MAAA,IAAa,OAAO,UAAA,CAAW,oBAAoB,UAAA,EAAY;AACjG,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,kDAAA,CAAoD,CAAA;AAAA,IACnG;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,UAAA,IAAc,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA;AACzD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,UAAA,EAAY;AAC7B,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,QAAQ,CAAA,WAAY,UAAU,CAAA;AAAA,IAC3D,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAAA,IAC3C,GAAA,EAAK,CAAC,QAAA,KAAmC,OAAA,CAAQ,IAAI,QAAoB,CAAA;AAAA,IACzE,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,GACrC;AACD","file":"chunk-6QX4I45I.js","sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent signals with the same name received before another\n\t * `awaitSignal` call are buffered (FIFO) so no signal is lost.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"]}
+{"version":3,"sources":["../actions/index.ts"],"names":[],"mappings":";AAyBO,IAAM,WAAA,GAAoC;AAAA,EAChD,gBAAA;AAAA,EACA,OAAA;AAAA,EACA,QAAA;AAAA,EACA,iBAAA;AAAA,EACA,iBAAA;AAAA,EACA;AACD;AAEO,SAAS,YAAY,KAAA,EAAmC;AAC9D,EAAA,OAAQ,WAAA,CAAkC,SAAS,KAAK,CAAA;AACzD;AAEO,SAAS,gBAAgB,KAAA,EAA2C;AAC1E,EAAA,IAAI,CAAC,WAAA,CAAY,KAAK,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACD;AA0QO,SAAS,eAAe,QAAA,EAAgD;AAC9E,EAAA,IAAI,CAAC,oCAAA,CAAqC,IAAA,CAAK,QAAQ,CAAA,EAAG;AACzD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,QAAQ,CAAA,CAAE,CAAA;AAAA,EACjD;AACD;AAUO,SAAS,oBAAA,CAAoC,WAAA,GAAgD,EAAC,EAAwB;AAC5H,EAAA,MAAM,OAAA,uBAAc,GAAA,EAAqC;AACzD,EAAA,MAAM,QAAA,GAAW,CAAC,UAAA,KAA4C;AAC7D,IAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAQ,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,uBAAA,CAAyB,CAAA;AAC7G,IAAA,IAAI,UAAA,CAAW,aAAA,IAAiB,UAAA,CAAW,WAAA,CAAY,WAAW,CAAA,EAAG;AACpE,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,8FAAA,CAAgG,CAAA;AAAA,IAC/I;AACA,IAAA,IAAI,WAAW,eAAA,KAAoB,MAAA,IAAa,OAAO,UAAA,CAAW,oBAAoB,UAAA,EAAY;AACjG,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,UAAA,CAAW,QAAQ,CAAA,kDAAA,CAAoD,CAAA;AAAA,IACnG;AACA,IAAA,OAAA,CAAQ,GAAA,CAAI,UAAA,CAAW,QAAA,EAAU,UAAU,CAAA;AAAA,EAC5C,CAAA;AACA,EAAA,KAAA,MAAW,UAAA,IAAc,WAAA,EAAa,QAAA,CAAS,UAAU,CAAA;AACzD,EAAA,OAAO;AAAA,IACN,QAAA;AAAA,IACA,kBAAkB,UAAA,EAAY;AAC7B,MAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,CAAI,WAAW,QAAQ,CAAA,WAAY,UAAU,CAAA;AAAA,IAC3D,CAAA;AAAA,IACA,OAAA,EAAS,CAAC,QAAA,KAAa,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAAA,IAC3C,GAAA,EAAK,CAAC,QAAA,KAAmC,OAAA,CAAQ,IAAI,QAAoB,CAAA;AAAA,IACzE,KAAK,MAAM,KAAA,CAAM,IAAA,CAAK,OAAA,CAAQ,MAAM;AAAA,GACrC;AACD","file":"chunk-PIDZQAEL.js","sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"]}

package/dist/chunk-Q4Q4JPR3.js

@@ -0,0 +1,524 @@
+// adapters/circuit-breaker.ts
+function classifyCircuitBreakerOutcome(kind) {
+  switch (kind) {
+    case "success":
+      return "success";
+    case "permanent_failure":
+      return "ignored";
+    case "transient_failure":
+    case "timeout":
+    case "ambiguous":
+      return "failure";
+    default:
+      return "failure";
+  }
+}
+var MANUAL_OVERRIDES = ["force_open", "force_closed"];
+function assertAdapterCircuitBreakerConfig(config) {
+  if (!config || typeof config !== "object") {
+    throw new RangeError("Adapter circuit breaker config must be an object.");
+  }
+  if (config.mode !== "monitor" && config.mode !== "enforce") {
+    throw new RangeError(`Adapter circuit breaker mode must be "monitor" or "enforce"; got ${JSON.stringify(config.mode)}.`);
+  }
+  if (!Number.isInteger(config.failureThreshold) || config.failureThreshold < 1) {
+    throw new RangeError(`Adapter circuit breaker failureThreshold must be a positive integer; got ${String(config.failureThreshold)}.`);
+  }
+  if (typeof config.windowMs !== "number" || !Number.isFinite(config.windowMs) || config.windowMs <= 0) {
+    throw new RangeError(`Adapter circuit breaker windowMs must be a positive number of milliseconds; got ${String(config.windowMs)}.`);
+  }
+  if (typeof config.cooldownMs !== "number" || !Number.isFinite(config.cooldownMs) || config.cooldownMs < 0) {
+    throw new RangeError(`Adapter circuit breaker cooldownMs must be a non-negative number of milliseconds; got ${String(config.cooldownMs)}.`);
+  }
+  if (config.minimumSamples !== void 0 && (!Number.isInteger(config.minimumSamples) || config.minimumSamples < 1)) {
+    throw new RangeError(`Adapter circuit breaker minimumSamples must be a positive integer; got ${String(config.minimumSamples)}.`);
+  }
+  if (config.probeLeaseMs !== void 0 && (typeof config.probeLeaseMs !== "number" || !Number.isFinite(config.probeLeaseMs) || config.probeLeaseMs <= 0)) {
+    throw new RangeError(`Adapter circuit breaker probeLeaseMs must be a positive number of milliseconds; got ${String(config.probeLeaseMs)}.`);
+  }
+  if (config.manualOverride !== void 0 && !MANUAL_OVERRIDES.includes(config.manualOverride)) {
+    throw new RangeError(`Adapter circuit breaker manualOverride must be "force_open" or "force_closed"; got ${JSON.stringify(config.manualOverride)}.`);
+  }
+}
+var InMemoryAdapterCircuitBreaker = class {
+  key;
+  mode;
+  config;
+  now;
+  onEvent;
+  probeLeaseMs;
+  samples = [];
+  state = "closed";
+  openedAt = 0;
+  probeIssuedAt;
+  /** Advances on every state change, manual override change and probe grant. */
+  generation = 0;
+  manualOverride;
+  /** Telemetry waiting for the current operation to commit. */
+  outbox = [];
+  operationDepth = 0;
+  flushing = false;
+  constructor(options) {
+    assertAdapterCircuitBreakerConfig(options.config);
+    this.key = options.key;
+    this.config = { ...options.config };
+    this.mode = options.config.mode;
+    this.now = options.now ?? Date.now;
+    this.onEvent = options.onEvent;
+    this.manualOverride = options.config.manualOverride;
+    this.probeLeaseMs = options.config.probeLeaseMs ?? Math.max(options.config.cooldownMs, options.config.windowMs);
+  }
+  getState() {
+    this.settle(this.now());
+    return this.reportedState();
+  }
+  getManualOverride() {
+    return this.manualOverride;
+  }
+  /**
+   * Set (`force_open` / `force_closed`) or clear (`undefined`) the manual
+   * override. Clearing returns the breaker to `closed` with its window intact.
+   */
+  setManualOverride(override) {
+    if (override !== void 0 && !MANUAL_OVERRIDES.includes(override)) {
+      throw new RangeError(`Adapter circuit breaker manualOverride must be "force_open" or "force_closed"; got ${JSON.stringify(override)}.`);
+    }
+    const now = this.now();
+    this.settle(now);
+    if (override === this.manualOverride) return;
+    this.operation(() => {
+      const from = this.reportedState();
+      this.manualOverride = override;
+      this.generation++;
+      if (override === void 0) {
+        this.state = "closed";
+        this.releaseProbe();
+      }
+      this.emit({
+        type: "state_change",
+        key: this.key,
+        mode: this.mode,
+        at: now,
+        from,
+        to: this.reportedState(),
+        reason: override === void 0 ? "manual_override_cleared" : "manual_override",
+        ...override ? { manualOverride: override } : {}
+      });
+    });
+  }
+  check() {
+    return this.decide(false, this.now());
+  }
+  acquire() {
+    const now = this.now();
+    this.settle(now);
+    return this.operation(() => this.decide(true, now));
+  }
+  record(outcome, admission) {
+    const now = this.now();
+    this.settle(now);
+    this.operation(() => this.applyOutcome(outcome, admission, now));
+  }
+  applyOutcome(outcome, admission, now) {
+    const generation = admission?.generation;
+    if (generation !== void 0 && generation !== this.generation) return;
+    const resolvesProbe = this.state === "half_open" && this.probeIssuedAt !== void 0 && (generation === void 0 || admission?.probe === true);
+    if (outcome === "ignored") {
+      if (resolvesProbe) this.releaseProbe();
+      return;
+    }
+    this.prune(now);
+    this.samples.push({ at: now, failure: outcome === "failure" });
+    if (this.manualOverride) return;
+    if (resolvesProbe) {
+      this.releaseProbe();
+      if (outcome === "success") {
+        this.samples = [];
+        this.transition("closed", "probe_succeeded", now);
+      } else {
+        this.openedAt = now;
+        this.transition("open", "probe_failed", now);
+      }
+      return;
+    }
+    if (this.state === "closed" && outcome === "failure" && this.shouldTrip()) {
+      this.openedAt = now;
+      this.transition("open", "failure_threshold", now);
+    }
+  }
+  /**
+   * `take` is false for {@link check}: a pure preview that sees an elapsed
+   * cooldown without committing it, takes no probe and emits nothing.
+   */
+  decide(take, now) {
+    if (this.manualOverride === "force_closed") {
+      return { allowed: true, state: "closed", probe: false, manualOverride: "force_closed", generation: this.generation };
+    }
+    if (this.manualOverride === "force_open") {
+      return this.refuse(take, { state: "open", manualOverride: "force_open" });
+    }
+    const cooldownElapsed = this.state === "open" && now - this.openedAt >= this.config.cooldownMs;
+    if (take) this.advance(now);
+    const state = !take && cooldownElapsed ? "half_open" : this.state;
+    if (state === "closed") return { allowed: true, state: "closed", probe: false, generation: this.generation };
+    if (state === "open") {
+      return this.refuse(take, {
+        state: "open",
+        retryAfterMs: Math.max(0, this.openedAt + this.config.cooldownMs - now)
+      });
+    }
+    const probeFree = !take && cooldownElapsed || this.probeIssuedAt === void 0 || now - this.probeIssuedAt >= this.probeLeaseMs;
+    if (!probeFree) return this.refuse(take, { state: "half_open" });
+    if (!take) return { allowed: true, state: "half_open", probe: true, generation: this.generation };
+    this.probeIssuedAt = now;
+    this.generation++;
+    return { allowed: true, state: "half_open", probe: true, generation: this.generation };
+  }
+  refuse(take, detail) {
+    const enforce = this.mode === "enforce";
+    if (take) {
+      this.emit({
+        type: enforce ? "rejected" : "would_reject",
+        key: this.key,
+        mode: this.mode,
+        at: this.now(),
+        ...detail
+      });
+    }
+    const generation = this.generation;
+    return enforce ? { allowed: false, probe: false, ...detail, generation } : { allowed: true, probe: false, wouldReject: true, ...detail, generation };
+  }
+  releaseProbe() {
+    this.probeIssuedAt = void 0;
+  }
+  /** Apply the time-based open → half_open transition. */
+  advance(now) {
+    if (this.state === "open" && now - this.openedAt >= this.config.cooldownMs) {
+      this.releaseProbe();
+      this.transition("half_open", "cooldown_elapsed", now);
+    }
+  }
+  shouldTrip() {
+    const minimumSamples = this.config.minimumSamples ?? this.config.failureThreshold;
+    const total = this.samples.length;
+    if (total < minimumSamples) return false;
+    let consecutive = 0;
+    for (let index = total - 1; index >= 0 && this.samples[index].failure; index--) consecutive++;
+    if (consecutive >= this.config.failureThreshold) return true;
+    const failures = this.samples.reduce((count, sample) => count + (sample.failure ? 1 : 0), 0);
+    return failures / total >= this.config.failureThreshold / minimumSamples;
+  }
+  prune(now) {
+    const cutoff = now - this.config.windowMs;
+    let drop = 0;
+    while (drop < this.samples.length && this.samples[drop].at < cutoff) drop++;
+    if (drop > 0) this.samples.splice(0, drop);
+  }
+  transition(to, reason, at) {
+    const from = this.state;
+    if (from === to) return;
+    this.state = to;
+    this.generation++;
+    this.emit({ type: "state_change", key: this.key, mode: this.mode, at, from, to, reason });
+  }
+  reportedState() {
+    if (this.manualOverride) return this.manualOverride === "force_open" ? "open" : "closed";
+    return this.state;
+  }
+  /**
+   * Commit an elapsed cooldown as an operation of its own, delivering its
+   * event before the caller's operation reads state.
+   */
+  settle(now) {
+    if (this.manualOverride) return;
+    this.operation(() => this.advance(now));
+  }
+  /**
+   * Run `step` to completion, then deliver the telemetry it produced. The
+   * return value is fixed before any listener runs.
+   */
+  operation(step) {
+    this.operationDepth++;
+    try {
+      return step();
+    } finally {
+      this.operationDepth--;
+      if (this.operationDepth === 0) this.flush();
+    }
+  }
+  emit(event) {
+    if (this.onEvent) this.outbox.push(event);
+  }
+  /**
+   * Deliver buffered events in order. A listener that calls back into the
+   * breaker queues its own events; this loop delivers them after it returns
+   * instead of recursing.
+   */
+  flush() {
+    if (this.flushing) return;
+    this.flushing = true;
+    try {
+      for (let event = this.outbox.shift(); event; event = this.outbox.shift()) this.deliver(event);
+    } finally {
+      this.flushing = false;
+    }
+  }
+  deliver(event) {
+    const listener = this.onEvent;
+    if (!listener) return;
+    try {
+      const result = listener(event);
+      if (result && typeof result.then === "function") {
+        result.then(void 0, () => void 0);
+      }
+    } catch {
+    }
+  }
+};
+function scopedAdapterCircuitBreakerKey(adapter, scope) {
+  return [
+    scope === void 0 ? "unscoped" : `tenant=${encodeURIComponent(scope.tenantId)}`,
+    scope?.spaceId === void 0 ? "space" : `space=${encodeURIComponent(scope.spaceId)}`,
+    adapter.vendor === void 0 ? "vendor" : `vendor=${encodeURIComponent(adapter.vendor)}`,
+    encodeURIComponent(adapter.adapterType),
+    encodeURIComponent(adapter.operation)
+  ].join(":");
+}
+var AdapterCircuitBreakerRegistry = class {
+  constructor(options = {}) {
+    this.options = options;
+  }
+  options;
+  breakers = /* @__PURE__ */ new Map();
+  forAdapter(adapter, scope) {
+    if (!adapter.circuitBreaker) return void 0;
+    const key = this.options.key?.(adapter, scope) ?? `${adapter.adapterType}:${adapter.operation}`;
+    let breaker = this.breakers.get(key);
+    if (!breaker) {
+      breaker = new InMemoryAdapterCircuitBreaker({
+        key,
+        config: adapter.circuitBreaker,
+        ...this.options.now ? { now: this.options.now } : {},
+        ...this.options.onEvent ? { onEvent: this.options.onEvent } : {}
+      });
+      this.breakers.set(key, breaker);
+    }
+    return breaker;
+  }
+  /** Looks up the default `adapterType:operation` key without creating a breaker. */
+  get(adapterType, operation) {
+    return this.getByKey(`${adapterType}:${operation}`);
+  }
+  /** Looks up an exact key, including a custom key, without creating a breaker. */
+  getByKey(key) {
+    return this.breakers.get(key);
+  }
+};
+var AdapterCircuitOpenError = class extends Error {
+  name = "AdapterCircuitOpenError";
+  code = "ADAPTER_CIRCUIT_OPEN";
+  reason = "circuit_open";
+  adapterKey;
+  state;
+  /** The attempt number that was refused (1 = refused before any call). */
+  attempt;
+  retryAfterMs;
+  manualOverride;
+  /** Error of the previous attempt, when the breaker opened mid-retry. */
+  lastError;
+  constructor(input) {
+    const after = input.retryAfterMs !== void 0 ? `; retry after ${input.retryAfterMs} ms` : "";
+    super(`Adapter circuit is ${input.state === "half_open" ? "half-open with its probe in flight" : "open"} for ${input.adapterKey}; the call was not attempted${after}.`);
+    this.adapterKey = input.adapterKey;
+    this.state = input.state;
+    this.attempt = input.attempt;
+    if (input.retryAfterMs !== void 0) this.retryAfterMs = input.retryAfterMs;
+    if (input.manualOverride !== void 0) this.manualOverride = input.manualOverride;
+    if (input.lastError !== void 0) this.lastError = input.lastError;
+  }
+};
+function isAdapterCircuitOpenError(error) {
+  if (error instanceof AdapterCircuitOpenError) return true;
+  return typeof error === "object" && error !== null && error.name === "AdapterCircuitOpenError" && error.code === "ADAPTER_CIRCUIT_OPEN";
+}
+
+// adapters/index.ts
+function adapterKey(adapterType, operation) {
+  return `${adapterType}:${operation}`;
+}
+var MissingAdapterRegistrationError = class extends Error {
+  constructor(adapterType, operation) {
+    super(`No adapter registered for adapterType "${adapterType}" and operation "${operation}"`);
+    this.name = "MissingAdapterRegistrationError";
+  }
+};
+var AdapterRegistry = class {
+  adapters = /* @__PURE__ */ new Map();
+  register(adapter) {
+    const key = adapterKey(adapter.adapterType, adapter.operation);
+    if (this.adapters.has(key)) {
+      throw new Error(
+        `Adapter already registered for adapterType "${adapter.adapterType}" and operation "${adapter.operation}"`
+      );
+    }
+    this.adapters.set(key, adapter);
+  }
+  resolve(adapterType, operation) {
+    return this.adapters.get(adapterKey(adapterType, operation));
+  }
+  require(adapterType, operation) {
+    const adapter = this.resolve(adapterType, operation);
+    if (!adapter) {
+      throw new MissingAdapterRegistrationError(adapterType, operation);
+    }
+    return adapter;
+  }
+};
+var DEFAULT_RETRY_POLICY = {
+  maxAttempts: 3,
+  initialDelayMs: 100,
+  backoffMultiplier: 2,
+  maxDelayMs: 1e3
+};
+var NO_RETRY_POLICY = {
+  idempotent: false,
+  maxAttempts: 1,
+  initialDelayMs: 0,
+  backoffMultiplier: 1,
+  maxDelayMs: 0
+};
+function resolveAdapterRetryPolicy(policy, defaultIdempotent) {
+  const idempotent = policy?.idempotent ?? defaultIdempotent;
+  if (!idempotent) {
+    return NO_RETRY_POLICY;
+  }
+  return {
+    idempotent: true,
+    maxAttempts: Math.max(1, Math.min(policy?.maxAttempts ?? DEFAULT_RETRY_POLICY.maxAttempts, 5)),
+    initialDelayMs: Math.max(0, policy?.initialDelayMs ?? DEFAULT_RETRY_POLICY.initialDelayMs),
+    backoffMultiplier: Math.max(
+      1,
+      policy?.backoffMultiplier ?? DEFAULT_RETRY_POLICY.backoffMultiplier
+    ),
+    maxDelayMs: Math.max(0, policy?.maxDelayMs ?? DEFAULT_RETRY_POLICY.maxDelayMs)
+  };
+}
+function getRetryDelayMs(attempt, policy) {
+  const exponentialDelay = policy.initialDelayMs * policy.backoffMultiplier ** Math.max(0, attempt - 1);
+  return Math.min(exponentialDelay, policy.maxDelayMs);
+}
+function classifyAdapterOutcome(result) {
+  if (result.outcome) {
+    assertAdapterOutcomeConsistency(result);
+    return result.outcome;
+  }
+  return result.success ? "success" : "transient_failure";
+}
+function shouldRetryAdapterOutcome(kind, idempotent) {
+  return kind === "transient_failure" && idempotent;
+}
+function assertAdapterOutcomeConsistency(result) {
+  if (result.success && result.outcome && result.outcome !== "success") {
+    throw new Error(
+      `Adapter returned success=true with contradictory outcome "${result.outcome}"; a successful result must not declare a non-success outcome.`
+    );
+  }
+}
+function recordCircuitOutcome(breaker, outcome, admission) {
+  if (!breaker) return;
+  try {
+    breaker.record(outcome, admission);
+  } catch {
+  }
+}
+function circuitOpenError(breaker, admission, attempt, lastError) {
+  return new AdapterCircuitOpenError({
+    adapterKey: breaker.key,
+    state: admission.state,
+    attempt,
+    ...admission.retryAfterMs !== void 0 ? { retryAfterMs: admission.retryAfterMs } : {},
+    ...admission.manualOverride !== void 0 ? { manualOverride: admission.manualOverride } : {},
+    ...lastError !== void 0 ? { lastError } : {}
+  });
+}
+async function executeWithAdapterRetry(options) {
+  const policy = resolveAdapterRetryPolicy(options.policy, options.defaultIdempotent);
+  const sleep = options.sleep ?? ((delayMs) => new Promise((resolve) => setTimeout(resolve, delayMs)));
+  const breaker = options.circuitBreaker;
+  let lastError;
+  for (let attempt = 1; attempt <= policy.maxAttempts; attempt++) {
+    let admission;
+    let executed = false;
+    let recorded = false;
+    const record = (outcome) => {
+      if (!executed || recorded) return;
+      recorded = true;
+      recordCircuitOutcome(breaker, outcome, admission);
+    };
+    let refusal;
+    async function handleThrown(error) {
+      lastError = error instanceof Error ? error.message : String(error);
+      const thrownOutcome = options.classifyThrownError ? options.classifyThrownError(error) : "transient_failure";
+      record(classifyCircuitBreakerOutcome(thrownOutcome));
+      let willRetry = shouldRetryAdapterOutcome(thrownOutcome, policy.idempotent) && attempt < policy.maxAttempts;
+      const blocked = willRetry ? refusedRetry(breaker) : void 0;
+      if (blocked) willRetry = false;
+      const nextDelayMs = willRetry ? getRetryDelayMs(attempt, policy) : void 0;
+      await options.onAttempt?.({ attempt, error: lastError, willRetry, nextDelayMs });
+      if (blocked) return blocked;
+      if (!willRetry) return "rethrow";
+      await sleep(nextDelayMs ?? 0);
+      return "retry";
+    }
+    try {
+      if (options.prepareAttempt) await options.prepareAttempt(attempt, policy.maxAttempts);
+    } catch (error) {
+      const decision = await handleThrown(error);
+      if (decision === "rethrow") throw error;
+      if (decision === "retry") continue;
+      refusal = decision;
+    }
+    if (!refusal) {
+      if (breaker) {
+        admission = breaker.acquire();
+        if (!admission.allowed) throw circuitOpenError(breaker, admission, attempt, lastError);
+      }
+      try {
+        executed = true;
+        const result = await options.execute(attempt, policy.maxAttempts);
+        if (options.isSuccessful(result)) {
+          record("success");
+          await options.onAttempt?.({ attempt, result, willRetry: false });
+          return result;
+        }
+        lastError = options.getError(result) ?? "Adapter returned unsuccessful result";
+        const outcome = options.classifyOutcome ? options.classifyOutcome(result) : "transient_failure";
+        record(classifyCircuitBreakerOutcome(outcome));
+        let willRetry = shouldRetryAdapterOutcome(outcome, policy.idempotent) && attempt < policy.maxAttempts;
+        refusal = willRetry ? refusedRetry(breaker) : void 0;
+        if (refusal) willRetry = false;
+        const nextDelayMs = willRetry ? getRetryDelayMs(attempt, policy) : void 0;
+        await options.onAttempt?.({ attempt, result, error: lastError, willRetry, nextDelayMs });
+        if (!willRetry && !refusal) {
+          return result;
+        }
+        if (!refusal) await sleep(nextDelayMs ?? 0);
+      } catch (error) {
+        const decision = await handleThrown(error);
+        if (decision === "rethrow") throw error;
+        refusal = decision === "retry" ? void 0 : decision;
+      }
+    }
+    if (refusal && breaker) throw circuitOpenError(breaker, refusal, attempt + 1, lastError);
+  }
+  throw new Error(lastError ?? "Adapter retry exhausted");
+}
+function refusedRetry(breaker) {
+  if (!breaker) return void 0;
+  const preview = breaker.check();
+  return preview.allowed ? void 0 : preview;
+}
+
+export { AdapterCircuitBreakerRegistry, AdapterCircuitOpenError, AdapterRegistry, InMemoryAdapterCircuitBreaker, MissingAdapterRegistrationError, assertAdapterCircuitBreakerConfig, assertAdapterOutcomeConsistency, classifyAdapterOutcome, classifyCircuitBreakerOutcome, executeWithAdapterRetry, getRetryDelayMs, isAdapterCircuitOpenError, resolveAdapterRetryPolicy, scopedAdapterCircuitBreakerKey, shouldRetryAdapterOutcome };
+//# sourceMappingURL=chunk-Q4Q4JPR3.js.map
+//# sourceMappingURL=chunk-Q4Q4JPR3.js.map