@fabricorg/platform 1.9.0 → 1.10.1

package/dist/actions/index.d.ts

@@ -1,91 +1,91 @@
-import { SurfaceDeclaration } from '../discovery/index.js';
-
-type ActionId = `${string}.${string}`;
-interface SchemaParseIssue {
-    path: PropertyKey[];
-    message: string;
+import { t as SurfaceDeclaration } from "../index-CIl1rYRv.js";
+//#region actions/index.d.ts
+export type ActionId = `${string}.${string}`;
+export interface SchemaParseIssue {
+  path: PropertyKey[];
+  message: string;
 }
-type SchemaParseResult<T = unknown> = {
-    success: true;
-    data: T;
+export type SchemaParseResult<T = unknown> = {
+  success: true;
+  data: T;
 } | {
-    success: false;
-    error: {
-        issues: SchemaParseIssue[];
-    };
+  success: false;
+  error: {
+    issues: SchemaParseIssue[];
+  };
 };
-interface SchemaValidator<T = unknown> {
-    parse(input: unknown): T;
-    safeParse(input: unknown): SchemaParseResult<T>;
+export interface SchemaValidator<T = unknown> {
+  parse(input: unknown): T;
+  safeParse(input: unknown): SchemaParseResult<T>;
 }
-type ActorType = "natural_person" | "agent" | "system" | "service_account" | "external_system" | "integration";
-declare const ACTOR_TYPES: readonly ActorType[];
-declare function isActorType(value: string): value is ActorType;
-declare function assertActorType(value: string): asserts value is ActorType;
-type ActionStatus = "pending" | "running" | "completed" | "failed" | "blocked_by_policy" | "waiting_for_approval" | "reconciliation_required" | "validation_failed";
-interface FabricRuntimeServices {
-    readonly [serviceName: string]: unknown;
+export type ActorType = "natural_person" | "agent" | "system" | "service_account" | "external_system" | "integration";
+export declare const ACTOR_TYPES: readonly ActorType[];
+export declare function isActorType(value: string): value is ActorType;
+export declare function assertActorType(value: string): asserts value is ActorType;
+export type ActionStatus = "pending" | "running" | "completed" | "failed" | "blocked_by_policy" | "waiting_for_approval" | "reconciliation_required" | "validation_failed";
+export interface FabricRuntimeServices {
+  readonly [serviceName: string]: unknown;
 }
-interface ActionContext<TDb = unknown> {
-    actionInvocationId: string;
-    tenantId: string;
-    spaceId: string;
-    actorId: string;
-    actorType: ActorType;
-    correlationId: string;
-    causationId?: string;
-    provenance?: {
-        source: string;
-        auditAttributes?: Record<string, string>;
-    };
-    db: TDb;
-    services?: FabricRuntimeServices;
-    /**
-     * When the host admitted this invocation's submission through the
-     * action's `admitSubmission` check, read from the durable invocation
-     * record. Absent when the action declares no check, or when the runtime
-     * that built this context does not run declared admission checks (a host
-     * older than the one that introduced them). A handler whose action
-     * declares `admitSubmission` can refuse to run without it.
-     */
-    admittedAt?: Date;
+export interface ActionContext<TDb = unknown> {
+  actionInvocationId: string;
+  tenantId: string;
+  spaceId: string;
+  actorId: string;
+  actorType: ActorType;
+  correlationId: string;
+  causationId?: string;
+  provenance?: {
+    source: string;
+    auditAttributes?: Record<string, string>;
+  };
+  db: TDb;
+  services?: FabricRuntimeServices;
+  /**
+   * When the host admitted this invocation's submission through the
+   * action's `admitSubmission` check, read from the durable invocation
+   * record. Absent when the action declares no check, or when the runtime
+   * that built this context does not run declared admission checks (a host
+   * older than the one that introduced them). A handler whose action
+   * declares `admitSubmission` can refuse to run without it.
+   */
+  admittedAt?: Date;
 }
 /**
  * Trusted facts a host gives an action's `admitSubmission` check. Scope and
  * actor come from the host's authenticated submission, never from the
  * parameters.
  */
-interface ActionAdmissionInput {
-    readonly actionId: ActionId;
-    readonly tenantId: string;
-    readonly spaceId: string;
-    readonly actorId: string;
-    readonly actorType: ActorType;
-    /**
-     * The submitted parameters, unvalidated, as a copy made for this check.
-     * `@fabricorg/platform-host` records its own copy of the same value, taken
-     * before the check ran, and only if the check admits it; changing this
-     * copy changes nothing the host records.
-     */
-    readonly parameters: Readonly<Record<string, unknown>>;
-    /**
-     * Aborted when the host's admission deadline passes. Hosts pass an
-     * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles
-     * at or after the deadline, even one that settles before the abort.
-     */
-    readonly signal: ActionAdmissionSignal;
+export interface ActionAdmissionInput {
+  readonly actionId: ActionId;
+  readonly tenantId: string;
+  readonly spaceId: string;
+  readonly actorId: string;
+  readonly actorType: ActorType;
+  /**
+   * The submitted parameters, unvalidated, as a copy made for this check.
+   * `@fabricorg/platform-host` records its own copy of the same value, taken
+   * before the check ran, and only if the check admits it; changing this
+   * copy changes nothing the host records.
+   */
+  readonly parameters: Readonly<Record<string, unknown>>;
+  /**
+   * Aborted when the host's admission deadline passes. Hosts pass an
+   * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles
+   * at or after the deadline, even one that settles before the abort.
+   */
+  readonly signal: ActionAdmissionSignal;
 }
 /**
  * The part of an `AbortSignal` an admission check can rely on. Declared
  * structurally so this module compiles without DOM or Node type libraries; a
  * host passes a real `AbortSignal`, which satisfies it.
  */
-interface ActionAdmissionSignal {
-    readonly aborted: boolean;
-    addEventListener(type: "abort", listener: () => void, options?: {
-        once?: boolean;
-    }): void;
-    removeEventListener(type: "abort", listener: () => void): void;
+export interface ActionAdmissionSignal {
+  readonly aborted: boolean;
+  addEventListener(type: "abort", listener: () => void, options?: {
+    once?: boolean;
+  }): void;
+  removeEventListener(type: "abort", listener: () => void): void;
 }
 /**
  * An admission check's answer. Only `{ admitted: true }` admits. A refusal's
@@ -93,11 +93,11 @@ interface ActionAdmissionSignal {
  * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never
  * a submitted value: the host puts it in the error it throws.
  */
-type ActionAdmissionDecision = {
-    readonly admitted: true;
+export type ActionAdmissionDecision = {
+  readonly admitted: true;
 } | {
-    readonly admitted: false;
-    readonly code: string;
+  readonly admitted: false;
+  readonly code: string;
 };
 /**
  * Decides whether a submission may be recorded at all. A host that supports
@@ -105,165 +105,164 @@ type ActionAdmissionDecision = {
  * anything durable for the submission; a refusal, a throw, a timeout or any
  * answer other than `{ admitted: true }` refuses the submission.
  */
-type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
-interface ActionResult {
-    success: boolean;
-    data?: Record<string, unknown>;
-    error?: string;
+export type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;
+export interface ActionResult {
+  success: boolean;
+  data?: Record<string, unknown>;
+  error?: string;
 }
-type ActionHandler<TDb = unknown> = (ctx: ActionContext<TDb>, params: unknown) => Promise<ActionResult>;
-interface AdapterStepRetryPolicy {
-    idempotent: boolean;
-    maxAttempts?: number;
-    initialDelayMs?: number;
-    backoffMultiplier?: number;
-    maxDelayMs?: number;
+export type ActionHandler<TDb = unknown> = (ctx: ActionContext<TDb>, params: unknown) => Promise<ActionResult>;
+export interface AdapterStepRetryPolicy {
+  idempotent: boolean;
+  maxAttempts?: number;
+  initialDelayMs?: number;
+  backoffMultiplier?: number;
+  maxDelayMs?: number;
 }
-interface AdapterStep {
-    adapterType: string;
-    operation: string;
-    retryPolicy?: AdapterStepRetryPolicy;
-    getInput: (params: unknown, handlerResult: Record<string, unknown>) => Record<string, unknown> | undefined;
+export interface AdapterStep {
+  adapterType: string;
+  operation: string;
+  retryPolicy?: AdapterStepRetryPolicy;
+  getInput: (params: unknown, handlerResult: Record<string, unknown>) => Record<string, unknown> | undefined;
 }
-interface ActionStateMachineBinding {
-    entityType: string;
-    targetState: string | ((params: unknown) => string);
-    getEntityId: (params: unknown) => string | undefined;
+export interface ActionStateMachineBinding {
+  entityType: string;
+  targetState: string | ((params: unknown) => string);
+  getEntityId: (params: unknown) => string | undefined;
 }
-interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
-    actionId: ActionId;
-    namespace: string;
-    version: number;
-    schema: SchemaValidator;
-    /**
-     * Optional check a host runs on every submission before it records
-     * anything durable for it (invocation, idempotency key, events, errors).
-     * Use it when parameters must be validated against trusted context, for
-     * example a secret reference the tenant's secret store must hold, before
-     * they may be persisted. `@fabricorg/platform-host` runs it from the
-     * release that introduced it; an older host ignores it, so a handler that
-     * relies on it should require `ActionContext.admittedAt`.
-     */
-    admitSubmission?: ActionAdmission;
-    /** Optional validation contract for the public handler result data. */
-    resultSchema?: SchemaValidator;
-    handler?: ActionHandler<TDb>;
-    requiredRoles?: string[];
-    requiredPermissions?: string[];
-    policies?: `${string}.v${number}`[];
-    emitsEvents: string[];
-    idempotent: boolean;
-    mutatesDomain: boolean;
-    /** Portable execution semantics used by hosts, gateways, and generated capability contracts. */
-    execution?: ActionExecutionContract;
-    stateMachine?: ActionStateMachineBinding;
-    adapterSteps?: AdapterStep[];
-    /** Completion actions can attest only after all external adapter work succeeds. */
-    eventPhase?: "before_adapters" | "after_adapters";
-    /**
-     * If "saga", the action is a multi-step orchestration. The worker dispatches
-     * to a registered saga implementation instead of running `handler` directly.
-     */
-    kind?: "atomic" | "saga";
+export interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {
+  actionId: ActionId;
+  namespace: string;
+  version: number;
+  schema: SchemaValidator;
+  /**
+   * Optional check a host runs on every submission before it records
+   * anything durable for it (invocation, idempotency key, events, errors).
+   * Use it when parameters must be validated against trusted context, for
+   * example a secret reference the tenant's secret store must hold, before
+   * they may be persisted. `@fabricorg/platform-host` runs it from the
+   * release that introduced it; an older host ignores it, so a handler that
+   * relies on it should require `ActionContext.admittedAt`.
+   */
+  admitSubmission?: ActionAdmission;
+  /** Optional validation contract for the public handler result data. */
+  resultSchema?: SchemaValidator;
+  handler?: ActionHandler<TDb>;
+  requiredRoles?: string[];
+  requiredPermissions?: string[];
+  policies?: `${string}.v${number}`[];
+  emitsEvents: string[];
+  idempotent: boolean;
+  mutatesDomain: boolean;
+  /** Portable execution semantics used by hosts, gateways, and generated capability contracts. */
+  execution?: ActionExecutionContract;
+  stateMachine?: ActionStateMachineBinding;
+  adapterSteps?: AdapterStep[];
+  /** Completion actions can attest only after all external adapter work succeeds. */
+  eventPhase?: "before_adapters" | "after_adapters";
+  /**
+   * If "saga", the action is a multi-step orchestration. The worker dispatches
+   * to a registered saga implementation instead of running `handler` directly.
+   */
+  kind?: "atomic" | "saga";
 }
-type ActionConnectivity = "online-required" | "offline-capturable";
-type AuthorityMoment = "capture" | "execution" | "both";
-type ActionIdempotencyStance = "required" | "supported" | "prohibited";
-type ActionCompletionMode = "immediate" | "accepted" | "long-running";
-type ActionConsistency = "authoritative-now" | "provisional-until-reconciled";
-type ActionDataSensitivity = "public" | "internal" | "confidential" | "restricted";
-interface ActionExecutionContract {
-    connectivity: ActionConnectivity;
-    authorityMoment: AuthorityMoment;
-    idempotency: ActionIdempotencyStance;
-    /**
-     * `immediate`: the invocation settles within the host's execution.
-     * `accepted` and `long-running`: an adapter may hand the work to an
-     * external system and the invocation stays running until that system
-     * completes it by reference through the host's completion ingress.
-     * Declare `completionDeadlineMs` on a `long-running` action so a callback
-     * that never comes is noticed rather than waited on forever.
-     */
-    completion: ActionCompletionMode;
-    /**
-     * How long an accepted handoff may wait for its completion before the host
-     * moves the invocation to reconciliation. Without it, nothing sweeps the
-     * handoff. Refused on `immediate`, since nothing external completes it.
-     */
-    completionDeadlineMs?: number;
-    consistency: ActionConsistency;
-    sensitivity?: ActionDataSensitivity;
+export type ActionConnectivity = "online-required" | "offline-capturable";
+export type AuthorityMoment = "capture" | "execution" | "both";
+export type ActionIdempotencyStance = "required" | "supported" | "prohibited";
+export type ActionCompletionMode = "immediate" | "accepted" | "long-running";
+export type ActionConsistency = "authoritative-now" | "provisional-until-reconciled";
+export type ActionDataSensitivity = "public" | "internal" | "confidential" | "restricted";
+export interface ActionExecutionContract {
+  connectivity: ActionConnectivity;
+  authorityMoment: AuthorityMoment;
+  idempotency: ActionIdempotencyStance;
+  /**
+   * `immediate`: the invocation settles within the host's execution.
+   * `accepted` and `long-running`: an adapter may hand the work to an
+   * external system and the invocation stays running until that system
+   * completes it by reference through the host's completion ingress.
+   * Declare `completionDeadlineMs` on a `long-running` action so a callback
+   * that never comes is noticed rather than waited on forever.
+   */
+  completion: ActionCompletionMode;
+  /**
+   * How long an accepted handoff may wait for its completion before the host
+   * moves the invocation to reconciliation. Without it, nothing sweeps the
+   * handoff. Refused on `immediate`, since nothing external completes it.
+   */
+  completionDeadlineMs?: number;
+  consistency: ActionConsistency;
+  sensitivity?: ActionDataSensitivity;
 }
-interface SagaContext {
-    actionInvocationId: string;
-    tenantId: string;
-    spaceId: string;
-    parameters: unknown;
-    sleep?: (delayMs: number) => Promise<void>;
-    query?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;
-    /**
-     * Wait for a named external signal carrying a payload of `T`, with a timeout.
-     *
-     * Resolves with the payload of the first signal received, or `null` if the timeout
-     * fires first. Subsequent distinct signals with the same name received before
-     * another `awaitSignal` call are buffered in FIFO order so none is lost.
-     *
-     * A signal may carry a stable signal ID that the sender keeps the same on each redelivery
-     * (for example a webhook delivery ID or an approval decision ID). A runtime drops
-     * a signal whose ID it has already received for this saga, so a sender retrying
-     * after a timeout does not wake the saga twice. Signals without an ID are not
-     * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`
-     * for Temporal runtimes.
-     *
-     * Intended for agent-driven and webhook-driven coordination: replace polling loops
-     * with push-based wakeups while preserving the saga's deterministic replay
-     * semantics (the runtime is responsible for capturing signals into workflow history).
-     *
-     * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory
-     * test harness) may omit this; sagas should treat absence as a fallback condition
-     * and use `sleep` + `query` polling instead.
-     *
-     * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`
-     * call from an action handler). Apps that need to send signals from action
-     * handlers should expose a coordination service via `ActionContext.services`
-     * — the platform does not prescribe the sender API.
-     *
-     * @example
-     * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(
-     *   "userInputProcessed",
-     *   5 * 60 * 1000,
-     * );
-     * if (payload) { /* handle pushed result *\/ }
-     * else        { /* timeout — fall back to deterministic path *\/ }
-     */
-    awaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;
+export interface SagaContext {
+  actionInvocationId: string;
+  tenantId: string;
+  spaceId: string;
+  parameters: unknown;
+  sleep?: (delayMs: number) => Promise<void>;
+  query?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;
+  /**
+   * Wait for a named external signal carrying a payload of `T`, with a timeout.
+   *
+   * Resolves with the payload of the first signal received, or `null` if the timeout
+   * fires first. Subsequent distinct signals with the same name received before
+   * another `awaitSignal` call are buffered in FIFO order so none is lost.
+   *
+   * A signal may carry a stable signal ID that the sender keeps the same on each redelivery
+   * (for example a webhook delivery ID or an approval decision ID). A runtime drops
+   * a signal whose ID it has already received for this saga, so a sender retrying
+   * after a timeout does not wake the saga twice. Signals without an ID are not
+   * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`
+   * for Temporal runtimes.
+   *
+   * Intended for agent-driven and webhook-driven coordination: replace polling loops
+   * with push-based wakeups while preserving the saga's deterministic replay
+   * semantics (the runtime is responsible for capturing signals into workflow history).
+   *
+   * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory
+   * test harness) may omit this; sagas should treat absence as a fallback condition
+   * and use `sleep` + `query` polling instead.
+   *
+   * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`
+   * call from an action handler). Apps that need to send signals from action
+   * handlers should expose a coordination service via `ActionContext.services`
+   * — the platform does not prescribe the sender API.
+   *
+   * @example
+   * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(
+   *   "userInputProcessed",
+   *   5 * 60 * 1000,
+   * );
+   * if (payload) { /* handle pushed result *\/ }
+   * else        { /* timeout — fall back to deterministic path *\/ }
+   */
+  awaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;
 }
-interface SagaChildActionInput {
-    suffix: string;
-    actionId: string;
-    parameters: Record<string, unknown>;
+export interface SagaChildActionInput {
+  suffix: string;
+  actionId: string;
+  parameters: Record<string, unknown>;
 }
-type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;
-interface SagaCompletionEvent {
-    eventType: string;
-    subjectType: string;
-    subjectId: string;
-    payload: unknown;
-    eventSchemaVersion?: number;
+export type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;
+export interface SagaCompletionEvent {
+  eventType: string;
+  subjectType: string;
+  subjectId: string;
+  payload: unknown;
+  eventSchemaVersion?: number;
 }
-interface SagaCompletion {
-    resultData: Record<string, unknown>;
-    event?: SagaCompletionEvent;
+export interface SagaCompletion {
+  resultData: Record<string, unknown>;
+  event?: SagaCompletionEvent;
 }
-type SagaImplementation = (ctx: SagaContext, runChild: SagaRunChild) => Promise<SagaCompletion>;
-declare function assertActionId(actionId: string): asserts actionId is ActionId;
-interface ActionRegistry<TDb = unknown> {
-    register(definition: ActionDefinition<TDb>): void;
-    registerIfMissing(definition: ActionDefinition<TDb>): void;
-    resolve(actionId: ActionId): ActionDefinition<TDb> | undefined;
-    has(actionId: string): actionId is ActionId;
-    ids(): ActionId[];
+export type SagaImplementation = (ctx: SagaContext, runChild: SagaRunChild) => Promise<SagaCompletion>;
+export declare function assertActionId(actionId: string): asserts actionId is ActionId;
+export interface ActionRegistry<TDb = unknown> {
+  register(definition: ActionDefinition<TDb>): void;
+  registerIfMissing(definition: ActionDefinition<TDb>): void;
+  resolve(actionId: ActionId): ActionDefinition<TDb> | undefined;
+  has(actionId: string): actionId is ActionId;
+  ids(): ActionId[];
 }
-declare function createActionRegistry<TDb = unknown>(definitions?: readonly ActionDefinition<TDb>[]): ActionRegistry<TDb>;
-
-export { ACTOR_TYPES, type ActionAdmission, type ActionAdmissionDecision, type ActionAdmissionInput, type ActionAdmissionSignal, type ActionCompletionMode, type ActionConnectivity, type ActionConsistency, type ActionContext, type ActionDataSensitivity, type ActionDefinition, type ActionExecutionContract, type ActionHandler, type ActionId, type ActionIdempotencyStance, type ActionRegistry, type ActionResult, type ActionStateMachineBinding, type ActionStatus, type ActorType, type AdapterStep, type AdapterStepRetryPolicy, type AuthorityMoment, type FabricRuntimeServices, type SagaChildActionInput, type SagaCompletion, type SagaCompletionEvent, type SagaContext, type SagaImplementation, type SagaRunChild, type SchemaParseIssue, type SchemaParseResult, type SchemaValidator, assertActionId, assertActorType, createActionRegistry, isActorType };
+export declare function createActionRegistry<TDb = unknown>(definitions?: readonly ActionDefinition<TDb>[]): ActionRegistry<TDb>;
+//#endregion

package/dist/actions/index.js

@@ -1,3 +1,42 @@
-export { ACTOR_TYPES, assertActionId, assertActorType, createActionRegistry, isActorType } from '../chunk-PIDZQAEL.js';
-//# sourceMappingURL=index.js.map
+//#region actions/index.ts
+const ACTOR_TYPES = [
+	"natural_person",
+	"agent",
+	"system",
+	"service_account",
+	"external_system",
+	"integration"
+];
+function isActorType(value) {
+	return ACTOR_TYPES.includes(value);
+}
+function assertActorType(value) {
+	if (!isActorType(value)) throw new Error(`Invalid actorType: ${value}`);
+}
+function assertActionId(actionId) {
+	if (!/^[a-z][a-z0-9-]*\.[a-z][a-z0-9_]*$/.test(actionId)) throw new Error(`Invalid action ID: ${actionId}`);
+}
+function createActionRegistry(definitions = []) {
+	const actions = /* @__PURE__ */ new Map();
+	const register = (definition) => {
+		assertActionId(definition.actionId);
+		if (actions.has(definition.actionId)) throw new Error(`Action "${definition.actionId}" is already registered`);
+		if (definition.mutatesDomain && definition.emitsEvents.length === 0) throw new Error(`Action "${definition.actionId}" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);
+		if (definition.admitSubmission !== void 0 && typeof definition.admitSubmission !== "function") throw new Error(`Action "${definition.actionId}" declares admitSubmission that is not a function.`);
+		actions.set(definition.actionId, definition);
+	};
+	for (const definition of definitions) register(definition);
+	return {
+		register,
+		registerIfMissing(definition) {
+			if (!actions.has(definition.actionId)) register(definition);
+		},
+		resolve: (actionId) => actions.get(actionId),
+		has: (actionId) => actions.has(actionId),
+		ids: () => Array.from(actions.keys())
+	};
+}
+//#endregion
+export { ACTOR_TYPES, assertActionId, assertActorType, createActionRegistry, isActorType };
+
 //# sourceMappingURL=index.js.map

package/dist/actions/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":[],"names":[],"mappings":"","file":"index.js"}
+{"version":3,"file":"index.js","names":[],"sources":["../../actions/index.ts"],"sourcesContent":["import type { SurfaceDeclaration } from \"../discovery\";\nexport type ActionId = `${string}.${string}`;\n\nexport interface SchemaParseIssue {\n\tpath: PropertyKey[];\n\tmessage: string;\n}\n\nexport type SchemaParseResult<T = unknown> =\n\t| { success: true; data: T }\n\t| { success: false; error: { issues: SchemaParseIssue[] } };\n\nexport interface SchemaValidator<T = unknown> {\n\tparse(input: unknown): T;\n\tsafeParse(input: unknown): SchemaParseResult<T>;\n}\n\nexport type ActorType =\n\t| \"natural_person\"\n\t| \"agent\"\n\t| \"system\"\n\t| \"service_account\"\n\t| \"external_system\"\n\t| \"integration\";\n\nexport const ACTOR_TYPES: readonly ActorType[] = [\n\t\"natural_person\",\n\t\"agent\",\n\t\"system\",\n\t\"service_account\",\n\t\"external_system\",\n\t\"integration\",\n] as const;\n\nexport function isActorType(value: string): value is ActorType {\n\treturn (ACTOR_TYPES as readonly string[]).includes(value);\n}\n\nexport function assertActorType(value: string): asserts value is ActorType {\n\tif (!isActorType(value)) {\n\t\tthrow new Error(`Invalid actorType: ${value}`);\n\t}\n}\n\nexport type ActionStatus =\n\t| \"pending\"\n\t| \"running\"\n\t| \"completed\"\n\t| \"failed\"\n\t| \"blocked_by_policy\"\n\t| \"waiting_for_approval\"\n\t| \"reconciliation_required\"\n\t| \"validation_failed\";\n\nexport interface FabricRuntimeServices {\n\treadonly [serviceName: string]: unknown;\n}\n\nexport interface ActionContext<TDb = unknown> {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tactorId: string;\n\tactorType: ActorType;\n\tcorrelationId: string;\n\tcausationId?: string;\n\tprovenance?: { source: string; auditAttributes?: Record<string, string> };\n\tdb: TDb;\n\tservices?: FabricRuntimeServices;\n\t/**\n\t * When the host admitted this invocation's submission through the\n\t * action's `admitSubmission` check, read from the durable invocation\n\t * record. Absent when the action declares no check, or when the runtime\n\t * that built this context does not run declared admission checks (a host\n\t * older than the one that introduced them). A handler whose action\n\t * declares `admitSubmission` can refuse to run without it.\n\t */\n\tadmittedAt?: Date;\n}\n\n/**\n * Trusted facts a host gives an action's `admitSubmission` check. Scope and\n * actor come from the host's authenticated submission, never from the\n * parameters.\n */\nexport interface ActionAdmissionInput {\n\treadonly actionId: ActionId;\n\treadonly tenantId: string;\n\treadonly spaceId: string;\n\treadonly actorId: string;\n\treadonly actorType: ActorType;\n\t/**\n\t * The submitted parameters, unvalidated, as a copy made for this check.\n\t * `@fabricorg/platform-host` records its own copy of the same value, taken\n\t * before the check ran, and only if the check admits it; changing this\n\t * copy changes nothing the host records.\n\t */\n\treadonly parameters: Readonly<Record<string, unknown>>;\n\t/**\n\t * Aborted when the host's admission deadline passes. Hosts pass an\n\t * `AbortSignal`. `@fabricorg/platform-host` refuses an answer that settles\n\t * at or after the deadline, even one that settles before the abort.\n\t */\n\treadonly signal: ActionAdmissionSignal;\n}\n\n/**\n * The part of an `AbortSignal` an admission check can rely on. Declared\n * structurally so this module compiles without DOM or Node type libraries; a\n * host passes a real `AbortSignal`, which satisfies it.\n */\nexport interface ActionAdmissionSignal {\n\treadonly aborted: boolean;\n\taddEventListener(type: \"abort\", listener: () => void, options?: { once?: boolean }): void;\n\tremoveEventListener(type: \"abort\", listener: () => void): void;\n}\n\n/**\n * An admission check's answer. Only `{ admitted: true }` admits. A refusal's\n * `code` must be a fixed code chosen by the action (lower-case first letter,\n * then letters, digits, `_`, `.`, `:` or `-`, at most 128 characters), never\n * a submitted value: the host puts it in the error it throws.\n */\nexport type ActionAdmissionDecision =\n\t| { readonly admitted: true }\n\t| { readonly admitted: false; readonly code: string };\n\n/**\n * Decides whether a submission may be recorded at all. A host that supports\n * it runs the check after authorizing the submitter and before it writes\n * anything durable for the submission; a refusal, a throw, a timeout or any\n * answer other than `{ admitted: true }` refuses the submission.\n */\nexport type ActionAdmission = (input: ActionAdmissionInput) => Promise<ActionAdmissionDecision>;\n\nexport interface ActionResult {\n\tsuccess: boolean;\n\tdata?: Record<string, unknown>;\n\terror?: string;\n}\n\nexport type ActionHandler<TDb = unknown> = (\n\tctx: ActionContext<TDb>,\n\tparams: unknown,\n) => Promise<ActionResult>;\n\nexport interface AdapterStepRetryPolicy {\n\tidempotent: boolean;\n\tmaxAttempts?: number;\n\tinitialDelayMs?: number;\n\tbackoffMultiplier?: number;\n\tmaxDelayMs?: number;\n}\n\nexport interface AdapterStep {\n\tadapterType: string;\n\toperation: string;\n\tretryPolicy?: AdapterStepRetryPolicy;\n\tgetInput: (\n\t\tparams: unknown,\n\t\thandlerResult: Record<string, unknown>,\n\t) => Record<string, unknown> | undefined;\n}\n\nexport interface ActionStateMachineBinding {\n\tentityType: string;\n\ttargetState: string | ((params: unknown) => string);\n\tgetEntityId: (params: unknown) => string | undefined;\n}\n\nexport interface ActionDefinition<TDb = unknown> extends SurfaceDeclaration {\n\tactionId: ActionId;\n\tnamespace: string;\n\tversion: number;\n\tschema: SchemaValidator;\n\t/**\n\t * Optional check a host runs on every submission before it records\n\t * anything durable for it (invocation, idempotency key, events, errors).\n\t * Use it when parameters must be validated against trusted context, for\n\t * example a secret reference the tenant's secret store must hold, before\n\t * they may be persisted. `@fabricorg/platform-host` runs it from the\n\t * release that introduced it; an older host ignores it, so a handler that\n\t * relies on it should require `ActionContext.admittedAt`.\n\t */\n\tadmitSubmission?: ActionAdmission;\n\t/** Optional validation contract for the public handler result data. */\n\tresultSchema?: SchemaValidator;\n\thandler?: ActionHandler<TDb>;\n\trequiredRoles?: string[];\n\trequiredPermissions?: string[];\n\tpolicies?: `${string}.v${number}`[];\n\temitsEvents: string[];\n\tidempotent: boolean;\n\tmutatesDomain: boolean;\n\t/** Portable execution semantics used by hosts, gateways, and generated capability contracts. */\n\texecution?: ActionExecutionContract;\n\tstateMachine?: ActionStateMachineBinding;\n\tadapterSteps?: AdapterStep[];\n\t/** Completion actions can attest only after all external adapter work succeeds. */\n\teventPhase?: \"before_adapters\" | \"after_adapters\";\n\t/**\n\t * If \"saga\", the action is a multi-step orchestration. The worker dispatches\n\t * to a registered saga implementation instead of running `handler` directly.\n\t */\n\tkind?: \"atomic\" | \"saga\";\n}\n\nexport type ActionConnectivity = \"online-required\" | \"offline-capturable\";\nexport type AuthorityMoment = \"capture\" | \"execution\" | \"both\";\nexport type ActionIdempotencyStance = \"required\" | \"supported\" | \"prohibited\";\nexport type ActionCompletionMode = \"immediate\" | \"accepted\" | \"long-running\";\nexport type ActionConsistency = \"authoritative-now\" | \"provisional-until-reconciled\";\nexport type ActionDataSensitivity = \"public\" | \"internal\" | \"confidential\" | \"restricted\";\n\nexport interface ActionExecutionContract {\n\tconnectivity: ActionConnectivity;\n\tauthorityMoment: AuthorityMoment;\n\tidempotency: ActionIdempotencyStance;\n\t/**\n\t * `immediate`: the invocation settles within the host's execution.\n\t * `accepted` and `long-running`: an adapter may hand the work to an\n\t * external system and the invocation stays running until that system\n\t * completes it by reference through the host's completion ingress.\n\t * Declare `completionDeadlineMs` on a `long-running` action so a callback\n\t * that never comes is noticed rather than waited on forever.\n\t */\n\tcompletion: ActionCompletionMode;\n\t/**\n\t * How long an accepted handoff may wait for its completion before the host\n\t * moves the invocation to reconciliation. Without it, nothing sweeps the\n\t * handoff. Refused on `immediate`, since nothing external completes it.\n\t */\n\tcompletionDeadlineMs?: number;\n\tconsistency: ActionConsistency;\n\tsensitivity?: ActionDataSensitivity;\n}\n\nexport interface SagaContext {\n\tactionInvocationId: string;\n\ttenantId: string;\n\tspaceId: string;\n\tparameters: unknown;\n\tsleep?: (delayMs: number) => Promise<void>;\n\tquery?: <T = unknown>(model: string, operation: string, args: unknown) => Promise<T>;\n\t/**\n\t * Wait for a named external signal carrying a payload of `T`, with a timeout.\n\t *\n\t * Resolves with the payload of the first signal received, or `null` if the timeout\n\t * fires first. Subsequent distinct signals with the same name received before\n\t * another `awaitSignal` call are buffered in FIFO order so none is lost.\n\t *\n\t * A signal may carry a stable signal ID that the sender keeps the same on each redelivery\n\t * (for example a webhook delivery ID or an approval decision ID). A runtime drops\n\t * a signal whose ID it has already received for this saga, so a sender retrying\n\t * after a timeout does not wake the saga twice. Signals without an ID are not\n\t * deduplicated. `@fabricorg/platform-temporal` provides `createSagaSignalInbox()`\n\t * for Temporal runtimes.\n\t *\n\t * Intended for agent-driven and webhook-driven coordination: replace polling loops\n\t * with push-based wakeups while preserving the saga's deterministic replay\n\t * semantics (the runtime is responsible for capturing signals into workflow history).\n\t *\n\t * Optional. Runtimes that cannot implement push-based signaling (e.g. an in-memory\n\t * test harness) may omit this; sagas should treat absence as a fallback condition\n\t * and use `sleep` + `query` polling instead.\n\t *\n\t * Signal *senders* are runtime-specific (e.g. a Temporal `WorkflowClient.signal()`\n\t * call from an action handler). Apps that need to send signals from action\n\t * handlers should expose a coordination service via `ActionContext.services`\n\t * — the platform does not prescribe the sender API.\n\t *\n\t * @example\n\t * const payload = await ctx.awaitSignal?.<{ result: Record<string, unknown> }>(\n\t *   \"userInputProcessed\",\n\t *   5 * 60 * 1000,\n\t * );\n\t * if (payload) { /* handle pushed result *\\/ }\n\t * else        { /* timeout — fall back to deterministic path *\\/ }\n\t */\n\tawaitSignal?: <T = unknown>(signalName: string, timeoutMs: number) => Promise<T | null>;\n}\n\nexport interface SagaChildActionInput {\n\tsuffix: string;\n\tactionId: string;\n\tparameters: Record<string, unknown>;\n}\n\nexport type SagaRunChild = (input: SagaChildActionInput) => Promise<Record<string, unknown>>;\n\nexport interface SagaCompletionEvent {\n\teventType: string;\n\tsubjectType: string;\n\tsubjectId: string;\n\tpayload: unknown;\n\teventSchemaVersion?: number;\n}\n\nexport interface SagaCompletion {\n\tresultData: Record<string, unknown>;\n\tevent?: SagaCompletionEvent;\n}\n\nexport type SagaImplementation = (\n\tctx: SagaContext,\n\trunChild: SagaRunChild,\n) => Promise<SagaCompletion>;\n\nexport function assertActionId(actionId: string): asserts actionId is ActionId {\n\tif (!/^[a-z][a-z0-9-]*\\.[a-z][a-z0-9_]*$/.test(actionId)) {\n\t\tthrow new Error(`Invalid action ID: ${actionId}`);\n\t}\n}\n\nexport interface ActionRegistry<TDb = unknown> {\n\tregister(definition: ActionDefinition<TDb>): void;\n\tregisterIfMissing(definition: ActionDefinition<TDb>): void;\n\tresolve(actionId: ActionId): ActionDefinition<TDb> | undefined;\n\thas(actionId: string): actionId is ActionId;\n\tids(): ActionId[];\n}\n\nexport function createActionRegistry<TDb = unknown>(definitions: readonly ActionDefinition<TDb>[] = []): ActionRegistry<TDb> {\n\tconst actions = new Map<ActionId, ActionDefinition<TDb>>();\n\tconst register = (definition: ActionDefinition<TDb>): void => {\n\t\tassertActionId(definition.actionId);\n\t\tif (actions.has(definition.actionId)) throw new Error(`Action \"${definition.actionId}\" is already registered`);\n\t\tif (definition.mutatesDomain && definition.emitsEvents.length === 0) {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" mutates domain but emits no events. Every mutating action must emit at least one AssetEvent.`);\n\t\t}\n\t\tif (definition.admitSubmission !== undefined && typeof definition.admitSubmission !== \"function\") {\n\t\t\tthrow new Error(`Action \"${definition.actionId}\" declares admitSubmission that is not a function.`);\n\t\t}\n\t\tactions.set(definition.actionId, definition);\n\t};\n\tfor (const definition of definitions) register(definition);\n\treturn {\n\t\tregister,\n\t\tregisterIfMissing(definition) {\n\t\t\tif (!actions.has(definition.actionId)) register(definition);\n\t\t},\n\t\tresolve: (actionId) => actions.get(actionId),\n\t\thas: (actionId): actionId is ActionId => actions.has(actionId as ActionId),\n\t\tids: () => Array.from(actions.keys()),\n\t};\n}\n"],"mappings":";AAyBA,MAAa,cAAoC;CAChD;CACA;CACA;CACA;CACA;CACA;AACD;AAEA,SAAgB,YAAY,OAAmC;CAC9D,OAAQ,YAAkC,SAAS,KAAK;AACzD;AAEA,SAAgB,gBAAgB,OAA2C;CAC1E,IAAI,CAAC,YAAY,KAAK,GACrB,MAAM,IAAI,MAAM,sBAAsB,OAAO;AAE/C;AA0QA,SAAgB,eAAe,UAAgD;CAC9E,IAAI,CAAC,qCAAqC,KAAK,QAAQ,GACtD,MAAM,IAAI,MAAM,sBAAsB,UAAU;AAElD;AAUA,SAAgB,qBAAoC,cAAgD,CAAC,GAAwB;CAC5H,MAAM,0BAAU,IAAI,IAAqC;CACzD,MAAM,YAAY,eAA4C;EAC7D,eAAe,WAAW,QAAQ;EAClC,IAAI,QAAQ,IAAI,WAAW,QAAQ,GAAG,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,wBAAwB;EAC7G,IAAI,WAAW,iBAAiB,WAAW,YAAY,WAAW,GACjE,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,+FAA+F;EAE/I,IAAI,WAAW,oBAAoB,KAAA,KAAa,OAAO,WAAW,oBAAoB,YACrF,MAAM,IAAI,MAAM,WAAW,WAAW,SAAS,mDAAmD;EAEnG,QAAQ,IAAI,WAAW,UAAU,UAAU;CAC5C;CACA,KAAK,MAAM,cAAc,aAAa,SAAS,UAAU;CACzD,OAAO;EACN;EACA,kBAAkB,YAAY;GAC7B,IAAI,CAAC,QAAQ,IAAI,WAAW,QAAQ,GAAG,SAAS,UAAU;EAC3D;EACA,UAAU,aAAa,QAAQ,IAAI,QAAQ;EAC3C,MAAM,aAAmC,QAAQ,IAAI,QAAoB;EACzE,WAAW,MAAM,KAAK,QAAQ,KAAK,CAAC;CACrC;AACD"}