@graphrefly/ts 0.0.0 → 0.0.1

package/dist/solutions/work-item/actions.js

@@ -0,0 +1,1454 @@
+import {
+  validateAcceptanceCriteria,
+  validateVerificationPlan
+} from "../../chunk-6XAIOL3X.js";
+import {
+  workItemDomainActionAdmissionProjector
+} from "../../chunk-PC3BTTBE.js";
+import {
+  depBatch
+} from "../../chunk-WQIA3GFB.js";
+import "../../chunk-S6HXABGL.js";
+import "../../chunk-DGUM43GV.js";
+
+// src/solutions/work-item/actions.ts
+var patchFieldKeys = /* @__PURE__ */ new Set([
+  "summary",
+  "detail",
+  "detailRefs",
+  "kind",
+  "priority",
+  "tags",
+  "owner",
+  "assignee",
+  "deadlineMs",
+  "customFields",
+  "sourceRefs",
+  "metadata"
+]);
+function workItemDomainActionProposal(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal",
+    proposalId,
+    workItemId,
+    actionKind,
+    effectRunId: opts.effectRunId ?? `domain-action:${proposalId}:effect-run`,
+    effectRunResultId: opts.effectRunResultId ?? `domain-action:${proposalId}:effect-run-result`,
+    evidenceId: opts.evidenceId ?? `domain-action:${proposalId}:evidence`,
+    policyId: opts.policyId ?? "domain-action-proposal",
+    payload: opts.payload,
+    reason: opts.reason,
+    sourceRefs: opts.sourceRefs,
+    proposedAtMs: opts.proposedAtMs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionProposalIntake(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal-intake",
+    proposalId,
+    workItemId,
+    actionKind,
+    payload: opts.payload,
+    reason: opts.reason,
+    policyId: opts.policyId,
+    effectRunId: opts.effectRunId,
+    effectRunResultId: opts.effectRunResultId,
+    evidenceId: opts.evidenceId,
+    proposedAtMs: opts.proposedAtMs,
+    sourceRefs: opts.sourceRefs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionApplyPolicy(policyId, opts = {}) {
+  return {
+    kind: "work-item-domain-action-apply-policy",
+    policyId,
+    actionKinds: opts.actionKinds,
+    patch: opts.patch,
+    spawn: opts.spawn,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionProposalIntakeProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionIntake";
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    [opts.proposals],
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) reduceProposalIntake(ctx, state, raw, now());
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionProposalIntakeProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    proposals: project(
+      graph,
+      runtime,
+      `${name}/proposals`,
+      "workItemDomainActionProposals",
+      (fact) => fact.kind === "proposal" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function workItemDomainActionApplicationProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionApplication";
+  const deps = opts.applyPolicies === void 0 ? [opts.proposals, opts.admissions, opts.workItems] : [opts.proposals, opts.admissions, opts.workItems, opts.applyPolicies];
+  const runtime = graph.node(
+    deps,
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Map(),
+        admissions: /* @__PURE__ */ new Map(),
+        workItems: /* @__PURE__ */ new Map(),
+        policies: /* @__PURE__ */ new Map(),
+        appliedAdmissions: /* @__PURE__ */ new Set(),
+        emittedFactIds: /* @__PURE__ */ new Set(),
+        issueKeys: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposal = raw;
+        if (state.proposals.has(proposal.proposalId)) {
+          emitApplicationIssue(
+            ctx,
+            state,
+            `duplicate-proposal:${proposal.proposalId}`,
+            "duplicate-suppressed",
+            `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`,
+            proposal.workItemId,
+            proposal.sourceRefs
+          );
+          continue;
+        }
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      for (const raw of depBatch(ctx, 2) ?? []) {
+        const workItem = raw;
+        state.workItems.set(workItem.workItemId, workItem);
+      }
+      if (opts.applyPolicies !== void 0) {
+        for (const raw of depBatch(ctx, 3) ?? []) {
+          const policy = raw;
+          state.policies.set(policy.policyId, policy);
+        }
+      }
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const admission = raw;
+        if (state.admissions.has(admission.admissionId)) {
+          emitApplicationIssue(
+            ctx,
+            state,
+            `duplicate-admission:${admission.admissionId}`,
+            "duplicate-suppressed",
+            `Duplicate WorkItem domain action admission '${admission.admissionId}' suppressed`,
+            admission.workItemId,
+            admissionRefs(admission)
+          );
+          continue;
+        }
+        state.admissions.set(admission.admissionId, admission);
+      }
+      for (const admission of state.admissions.values()) applyAdmission(ctx, state, admission);
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionApplicationProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    authoringFacts: project(
+      graph,
+      runtime,
+      `${name}/authoringFacts`,
+      "workItemDomainActionAuthoringFacts",
+      (fact) => fact.kind === "authoring-fact" ? fact.value : void 0
+    ),
+    applications: project(
+      graph,
+      runtime,
+      `${name}/applications`,
+      "workItemDomainActionApplications",
+      (fact) => fact.kind === "application" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function workItemDomainActionCapabilityGuardProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionCapabilityGuard";
+  const deps = opts.capabilityAdmissionStatus === void 0 ? [opts.proposals, opts.capabilityAdmissions, opts.guardPolicies] : [
+    opts.proposals,
+    opts.capabilityAdmissions,
+    opts.guardPolicies,
+    opts.capabilityAdmissionStatus
+  ];
+  const statusIndex = opts.capabilityAdmissionStatus === void 0 ? -1 : 3;
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    deps,
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Map(),
+        admissionsByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesWithoutCapability: [],
+        policies: /* @__PURE__ */ new Map(),
+        emittedProposalDecisions: /* @__PURE__ */ new Set(),
+        emittedStatusKeys: /* @__PURE__ */ new Set(),
+        issueKeys: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 2) ?? []) {
+        const policyIssue = capabilityGuardPolicyIssue(raw);
+        if (policyIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-policy:${recordString(raw, "policyId") ?? "unknown"}`,
+            policyIssue
+          );
+          continue;
+        }
+        const policy = raw;
+        state.policies.set(policy.policyId, policy);
+      }
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const admissionIssue = capabilityAdmissionIssue(raw);
+        if (admissionIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-admission:${recordString(raw, "admissionId") ?? "unknown"}`,
+            admissionIssue
+          );
+          continue;
+        }
+        const admission = raw;
+        const capabilityKey = capabilityBoundaryRefId(admission.capability);
+        const byCapability = state.admissionsByCapability.get(capabilityKey) ?? [];
+        if (!byCapability.some((item) => item.admissionId === admission.admissionId)) {
+          state.admissionsByCapability.set(capabilityKey, [...byCapability, admission]);
+        }
+      }
+      if (statusIndex >= 0) {
+        for (const raw of depBatch(ctx, statusIndex) ?? []) {
+          const statusIssue = capabilityAdmissionStatusIssue(raw);
+          if (statusIssue !== void 0) {
+            emitCapabilityGuardIssue(
+              ctx,
+              state,
+              `malformed-capability-status:${recordString(raw, "statusId") ?? "unknown"}`,
+              statusIssue
+            );
+            continue;
+          }
+          const status = raw;
+          if (status.state !== "capability-admission-issue") continue;
+          const capabilityId = status.capabilityId;
+          const capabilityKind = status.capabilityKind;
+          if (capabilityId !== void 0 && capabilityKind !== void 0) {
+            const capabilityKey = capabilityBoundaryRefId({
+              id: capabilityId,
+              kind: capabilityKind
+            });
+            const statuses = state.issueStatusesByCapability.get(capabilityKey) ?? [];
+            if (!statuses.some((item) => item.statusId === status.statusId)) {
+              state.issueStatusesByCapability.set(capabilityKey, [...statuses, status]);
+            }
+          } else if (!state.issueStatusesWithoutCapability.some((item) => item.statusId === status.statusId)) {
+            state.issueStatusesWithoutCapability.push(status);
+          }
+          for (const proposal of state.proposals.values())
+            emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+        }
+      }
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposalIssue = capabilityGuardProposalIssue(raw);
+        if (proposalIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-proposal:${recordString(raw, "proposalId") ?? "unknown"}`,
+            proposalIssue
+          );
+          continue;
+        }
+        const proposal = raw;
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      for (const proposal of state.proposals.values())
+        evaluateCapabilityGuardProposal(ctx, state, proposal, now());
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionCapabilityGuardProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    decisions: project(
+      graph,
+      runtime,
+      `${name}/decisions`,
+      "workItemDomainActionCapabilityGuardDecisions",
+      (fact) => fact.kind === "decision" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionCapabilityGuardStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionCapabilityGuardIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionCapabilityGuardAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function evaluateCapabilityGuardProposal(ctx, state, proposal, decidedAtMs) {
+  if (state.emittedProposalDecisions.has(proposal.proposalId)) return;
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") {
+    emitCapabilityGuardIssue(
+      ctx,
+      state,
+      `policy:${proposal.proposalId}:${policy}`,
+      dataIssue(policy, capabilityGuardPolicyMessage(policy, proposal), {
+        subjectId: proposal.workItemId,
+        refs: [ref("work-item-domain-action-proposal", proposal.proposalId)]
+      })
+    );
+    return;
+  }
+  for (const status of state.issueStatusesWithoutCapability)
+    emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  for (const capabilityRef of policy.capabilityRefs) {
+    for (const status of state.issueStatusesByCapability.get(
+      capabilityBoundaryRefId(capabilityRef)
+    ) ?? [])
+      emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  }
+  const admissions = policy.capabilityRefs.map(
+    (capabilityRef) => latestCapabilityAdmission(state, policy, capabilityRef)
+  );
+  const missingCapabilityRefs = policy.capabilityRefs.filter(
+    (_, index) => admissions[index] === void 0
+  );
+  const deferredCapabilityRefs = admissions.filter((admission) => admission !== void 0).filter((admission) => admission.state === "deferred").map((admission) => capabilityBoundaryRefId(admission.capability));
+  if (missingCapabilityRefs.length > 0 || deferredCapabilityRefs.length > 0) {
+    emitCapabilityGuardStatusOnce(
+      ctx,
+      state,
+      `deferred:${proposal.proposalId}:${policy.policyId}:missing=${missingCapabilityRefs.map(capabilityBoundaryRefId).join(",")}:deferred=${deferredCapabilityRefs.join(",")}`,
+      {
+        state: "deferred",
+        workItemId: proposal.workItemId,
+        proposalId: proposal.proposalId,
+        actionKind: proposal.actionKind,
+        policyId: policy.policyId,
+        capabilityRefs: policy.capabilityRefs,
+        admissionSubjectIds: policy.admissionSubjectIds,
+        message: "WorkItem domain action is waiting for capability admission",
+        sourceRefs: capabilityGuardRefs(proposal, policy, admissions),
+        metadata: {
+          missingCapabilityRefs: missingCapabilityRefs.map(capabilityBoundaryRefId),
+          deferredCapabilityRefs
+        }
+      }
+    );
+    return;
+  }
+  const presentAdmissions = admissions.filter(
+    (admission) => admission !== void 0
+  );
+  const blocked = presentAdmissions.filter((admission) => admission.state === "blocked");
+  const outcome = blocked.length === 0 ? "admit" : "reject";
+  const decision = {
+    kind: "work-item-domain-action-admission-decision",
+    decisionId: `capability-guard:${proposal.proposalId}:decision`,
+    admissionId: `capability-guard:${proposal.proposalId}:admission`,
+    proposalId: proposal.proposalId,
+    outcome,
+    reason: blocked.length === 0 ? "Capability guard admitted required capabilities" : "Capability guard rejected blocked capabilities",
+    decidedAtMs,
+    sourceRefs: capabilityGuardRefs(proposal, policy, presentAdmissions),
+    metadata: {
+      capabilityGuardPolicyId: policy.policyId,
+      capabilityRefs: policy.capabilityRefs.map(capabilityBoundaryRefId),
+      admissionSubjectIds: policy.admissionSubjectIds,
+      blockedCapabilityRefs: blocked.map(
+        (admission) => capabilityBoundaryRefId(admission.capability)
+      )
+    }
+  };
+  state.emittedProposalDecisions.add(proposal.proposalId);
+  emitCapabilityGuard(ctx, "decision", decision);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: outcome === "admit" ? "admitted" : "rejected",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    policyId: policy.policyId,
+    capabilityRefs: policy.capabilityRefs,
+    admissionSubjectIds: policy.admissionSubjectIds,
+    admissionIds: presentAdmissions.map((admission) => admission.admissionId),
+    sourceRefs: decision.sourceRefs,
+    metadata: { decisionId: decision.decisionId, admissionId: decision.admissionId }
+  });
+}
+function capabilityGuardProposalIssue(proposal) {
+  if (!isRecord(proposal) || proposal.kind !== "work-item-domain-action-proposal" || typeof proposal.proposalId !== "string" || proposal.proposalId.length === 0 || typeof proposal.workItemId !== "string" || proposal.workItemId.length === 0 || typeof proposal.actionKind !== "string" || proposal.actionKind.length === 0 || proposal.sourceRefs !== void 0 && !isSourceRefArray(proposal.sourceRefs)) {
+    return dataIssue(
+      "malformed-work-item-domain-action-capability-guard-proposal",
+      "WorkItem domain action capability guard requires valid proposal DATA facts",
+      { subjectId: recordString(proposal, "workItemId") }
+    );
+  }
+  return void 0;
+}
+function capabilityGuardPolicyIssue(policy) {
+  if (!isRecord(policy) || policy.kind !== "work-item-domain-action-capability-guard-policy" || typeof policy.policyId !== "string" || policy.policyId.length === 0 || !Array.isArray(policy.capabilityRefs) || policy.capabilityRefs.length === 0 || !policy.capabilityRefs.every(isBoundaryCapabilityRef) || !Array.isArray(policy.admissionSubjectIds) || policy.admissionSubjectIds.length === 0 || !policy.admissionSubjectIds.every((id) => typeof id === "string" && id.length > 0) || policy.actionKinds !== void 0 && (!Array.isArray(policy.actionKinds) || !policy.actionKinds.every((kind) => typeof kind === "string" && kind.length > 0))) {
+    return dataIssue(
+      "malformed-work-item-domain-action-capability-guard-policy",
+      "WorkItem domain action capability guard policy requires policyId, capabilityRefs, and admissionSubjectIds",
+      {
+        subjectId: recordString(policy, "policyId")
+      }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionIssue(admission) {
+  if (!isRecord(admission) || admission.kind !== "capability-admission" || typeof admission.admissionId !== "string" || admission.admissionId.length === 0 || typeof admission.proposalId !== "string" || admission.proposalId.length === 0 || typeof admission.subjectId !== "string" || admission.subjectId.length === 0 || !isBoundaryCapabilityRef(admission.capability) || !isCapabilityAdmissionState(admission.state) || typeof admission.decisionId !== "string" || admission.decisionId.length === 0 || admission.sourceRefs !== void 0 && !isSourceRefArray(admission.sourceRefs)) {
+    return dataIssue(
+      "malformed-capability-admission",
+      "WorkItem domain action capability guard requires valid CapabilityAdmission DATA facts",
+      { subjectId: recordString(admission, "subjectId") }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionStatusIssue(status) {
+  if (!isRecord(status) || status.kind !== "capability-admission-status" || typeof status.statusId !== "string" || status.statusId.length === 0 || !isCapabilityAdmissionStatusState(status.state)) {
+    return dataIssue(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
+  }
+  const hasCapabilityId = status.capabilityId !== void 0;
+  const hasCapabilityKind = status.capabilityKind !== void 0;
+  if (hasCapabilityId !== hasCapabilityKind || hasCapabilityId && (typeof status.capabilityId !== "string" || status.capabilityId.length === 0 || !isBoundaryCapabilityKind(status.capabilityKind)) || status.sourceRefs !== void 0 && !isSourceRefArray(status.sourceRefs) || status.issues !== void 0 && !isDataIssueArray(status.issues)) {
+    return dataIssue(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
+  }
+  return void 0;
+}
+function isCapabilityAdmissionState(value) {
+  return value === "allowed" || value === "blocked" || value === "deferred";
+}
+function isCapabilityAdmissionStatusState(value) {
+  return value === "capability-admission-allowed" || value === "capability-admission-blocked" || value === "capability-admission-deferred" || value === "capability-admission-issue";
+}
+function isSourceRefArray(value) {
+  return Array.isArray(value) && value.every(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
+}
+function isDataIssueArray(value) {
+  return Array.isArray(value) && value.every(isDataIssue);
+}
+function isDataIssue(value) {
+  return isRecord(value) && value.kind === "issue" && typeof value.code === "string" && value.code.length > 0 && typeof value.message === "string" && value.message.length > 0;
+}
+function isBoundaryCapabilityRef(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && isBoundaryCapabilityKind(value.kind) && typeof value.required === "boolean" && (value.sourceRefs === void 0 || Array.isArray(value.sourceRefs) && value.sourceRefs.every((sourceRef) => typeof sourceRef === "string"));
+}
+function isBoundaryCapabilityKind(value) {
+  return value === "auth" || value === "permission" || value === "config" || value === "resource";
+}
+function selectCapabilityGuardPolicy(state, proposal) {
+  const explicitId = stringMetadata(proposal.metadata, "capabilityGuardPolicyId") ?? proposal.sourceRefs?.find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-capability-guard-policy"
+  )?.id;
+  if (explicitId !== void 0)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-capability-guard-policy";
+  const matching = [...state.policies.values()].filter(
+    (policy) => policy.actionKinds === void 0 || policy.actionKinds.includes(proposal.actionKind)
+  );
+  if (matching.length === 0) return "missing-policy";
+  if (matching.length > 1) return "policy-mismatch";
+  return matching[0];
+}
+function latestCapabilityAdmission(state, policy, capabilityRef) {
+  const admissions = state.admissionsByCapability.get(capabilityBoundaryRefId(capabilityRef)) ?? [];
+  for (let index = admissions.length - 1; index >= 0; index -= 1) {
+    const admission = admissions[index];
+    if (admission !== void 0 && policy.admissionSubjectIds.includes(admission.subjectId))
+      return admission;
+  }
+  return void 0;
+}
+function emitCapabilityStatusIssueForProposal(ctx, state, proposal, status) {
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") return;
+  if (status.subjectId !== void 0 && !policy.admissionSubjectIds.includes(status.subjectId))
+    return;
+  const capabilityId = status.capabilityId;
+  const capabilityKind = status.capabilityKind;
+  const statusCapabilityKey = capabilityId === void 0 || capabilityKind === void 0 ? void 0 : capabilityBoundaryRefId({ id: capabilityId, kind: capabilityKind });
+  if (statusCapabilityKey !== void 0 && !policy.capabilityRefs.some(
+    (capabilityRef) => capabilityBoundaryRefId(capabilityRef) === statusCapabilityKey
+  ))
+    return;
+  const issue = status.issues?.[0] ?? dataIssue(
+    "capability-admission-status-issue",
+    "Capability admission status reported an issue",
+    { subjectId: proposal.workItemId }
+  );
+  emitCapabilityGuardIssue(
+    ctx,
+    state,
+    `capability-status:${proposal.proposalId}:${status.statusId}`,
+    dataIssue(issue.code, issue.message, {
+      subjectId: proposal.workItemId,
+      refs: uniqueSourceRefs([
+        ...capabilityGuardRefs(proposal, policy),
+        ...status.sourceRefs ?? []
+      ]),
+      metadata: {
+        ...statusCapabilityKey === void 0 ? {} : { capabilityRef: statusCapabilityKey },
+        capabilityAdmissionStatusId: status.statusId
+      }
+    })
+  );
+}
+function capabilityGuardPolicyMessage(code, proposal) {
+  if (code === "missing-policy")
+    return `WorkItem domain action '${proposal.proposalId}' has no capability guard policy`;
+  if (code === "unknown-work-item-domain-action-capability-guard-policy")
+    return `WorkItem domain action '${proposal.proposalId}' references a missing capability guard policy`;
+  return `WorkItem domain action '${proposal.proposalId}' matches multiple capability guard policies`;
+}
+function capabilityGuardRefs(proposal, policy, admissions = []) {
+  return uniqueSourceRefs([
+    ref("work-item", proposal.workItemId),
+    ref("work-item-domain-action-proposal", proposal.proposalId),
+    ref("work-item-domain-action-capability-guard-policy", policy.policyId),
+    ...admissions.filter((admission) => admission !== void 0).flatMap((admission) => [
+      ref("capability-admission", admission.admissionId),
+      ref("capability-admission-proposal", admission.proposalId),
+      ref("boundary-capability", capabilityBoundaryRefId(admission.capability)),
+      ...admission.sourceRefs ?? []
+    ]),
+    ...proposal.sourceRefs ?? []
+  ]);
+}
+function capabilityBoundaryRefId(capability) {
+  return `${capability.kind}:${capability.id}`;
+}
+function emitCapabilityGuardStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-capability-guard-status",
+    statusId: `work-item-domain-action-capability-guard-status:${state.statusSeq}`,
+    ...status
+  };
+  emitCapabilityGuard(ctx, "status", statusFact);
+  state.auditSeq += 1;
+  emitCapabilityGuard(ctx, "audit", {
+    id: `work-item-domain-action-capability-guard-status:${state.auditSeq}`,
+    kind: "work-item-domain-action-capability-guard-status",
+    subjectId: status.workItemId,
+    message: status.message,
+    sourceRefs: status.sourceRefs,
+    metadata: {
+      statusId: statusFact.statusId,
+      state: status.state,
+      proposalId: status.proposalId,
+      policyId: status.policyId,
+      ...status.metadata ?? {}
+    }
+  });
+}
+function emitCapabilityGuardStatusOnce(ctx, state, key, status) {
+  if (state.emittedStatusKeys.has(key)) return;
+  state.emittedStatusKeys.add(key);
+  emitCapabilityGuardStatus(ctx, state, status);
+}
+function emitCapabilityGuardIssue(ctx, state, key, issue) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  emitCapabilityGuard(ctx, "issue", issue);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: "issue",
+    workItemId: issue.subjectId,
+    issues: [issue],
+    message: issue.message,
+    metadata: { issueCode: issue.code }
+  });
+}
+function emitCapabilityGuard(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+function reduceProposalIntake(ctx, state, input, proposedAtMs) {
+  const proposal = normalizeProposal(input, proposedAtMs);
+  if (typeof proposal === "string") {
+    const issue = dataIssue("malformed-domain-action-proposal", proposal);
+    emitIntake(ctx, "issue", issue);
+    emitIntakeStatus(ctx, state, {
+      state: "rejected",
+      code: issue.code,
+      message: issue.message
+    });
+    return;
+  }
+  if (state.proposals.has(proposal.proposalId)) {
+    emitIntakeStatus(ctx, state, {
+      state: "duplicate",
+      code: "duplicate-suppressed",
+      workItemId: proposal.workItemId,
+      proposalId: proposal.proposalId,
+      actionKind: proposal.actionKind,
+      message: `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`
+    });
+    return;
+  }
+  state.proposals.add(proposal.proposalId);
+  emitIntake(ctx, "proposal", proposal);
+  emitIntakeStatus(ctx, state, {
+    state: "proposed",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    sourceRefs: proposal.sourceRefs
+  });
+}
+function normalizeProposal(input, proposedAtMs) {
+  if (!isRecord(input)) return "WorkItemDomainActionProposal intake must be an object";
+  if (input.kind !== "work-item-domain-action-proposal" && input.kind !== "work-item-domain-action-proposal-intake")
+    return "WorkItemDomainActionProposal intake has unsupported kind";
+  if (typeof input.proposalId !== "string" || input.proposalId.trim() === "")
+    return "WorkItemDomainActionProposal.proposalId is required";
+  if (typeof input.workItemId !== "string" || input.workItemId.trim() === "")
+    return "WorkItemDomainActionProposal.workItemId is required";
+  if (typeof input.actionKind !== "string" || input.actionKind.trim() === "")
+    return "WorkItemDomainActionProposal.actionKind is required";
+  if (input.kind === "work-item-domain-action-proposal") {
+    if (typeof input.effectRunId !== "string")
+      return "WorkItemDomainActionProposal.effectRunId is required";
+    if (typeof input.effectRunResultId !== "string")
+      return "WorkItemDomainActionProposal.effectRunResultId is required";
+    if (typeof input.evidenceId !== "string")
+      return "WorkItemDomainActionProposal.evidenceId is required";
+    if (typeof input.policyId !== "string")
+      return "WorkItemDomainActionProposal.policyId is required";
+    return input;
+  }
+  return workItemDomainActionProposal(
+    input.proposalId,
+    input.workItemId,
+    input.actionKind,
+    {
+      payload: input.payload,
+      reason: typeof input.reason === "string" ? input.reason : void 0,
+      policyId: typeof input.policyId === "string" ? input.policyId : void 0,
+      effectRunId: typeof input.effectRunId === "string" ? input.effectRunId : void 0,
+      effectRunResultId: typeof input.effectRunResultId === "string" ? input.effectRunResultId : void 0,
+      evidenceId: typeof input.evidenceId === "string" ? input.evidenceId : void 0,
+      proposedAtMs: typeof input.proposedAtMs === "number" ? input.proposedAtMs : proposedAtMs,
+      sourceRefs: sourceRefs(input.sourceRefs),
+      metadata: isRecord(input.metadata) ? input.metadata : void 0
+    }
+  );
+}
+function applyAdmission(ctx, state, admission) {
+  if (state.appliedAdmissions.has(admission.admissionId)) return;
+  const proposal = state.proposals.get(admission.proposalId);
+  if (proposal === void 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-proposal:${admission.admissionId}:${admission.proposalId}`,
+      "dangling-ref",
+      `Admission '${admission.admissionId}' cannot apply without proposal '${admission.proposalId}'`,
+      admission.workItemId,
+      admissionRefs(admission)
+    );
+    return;
+  }
+  if (admission.state !== "admitted") {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplication(ctx, state, admission, proposal, admission.state, []);
+    return;
+  }
+  const mismatch = admissionProposalMismatch(admission, proposal);
+  if (mismatch !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `admission-proposal-mismatch:${admission.admissionId}:${mismatch.field}`,
+      "dangling-ref",
+      mismatch.message,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      {
+        field: mismatch.field,
+        admissionValue: mismatch.admissionValue,
+        proposalValue: mismatch.proposalValue
+      }
+    );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: "dangling-ref",
+      message: mismatch.message
+    });
+    return;
+  }
+  const workItem = state.workItems.get(admission.workItemId);
+  if (workItem === void 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-work-item:${admission.admissionId}:${admission.workItemId}`,
+      "dangling-ref",
+      `Admission '${admission.admissionId}' references unknown WorkItem '${admission.workItemId}'`,
+      admission.workItemId,
+      admissionRefs(admission, proposal)
+    );
+    return;
+  }
+  const metadataConflict = conflictingApplicationMetadata(proposal, admission);
+  if (metadataConflict !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `metadata-conflict:${admission.admissionId}:${metadataConflict.field}`,
+      metadataConflict.code,
+      metadataConflict.message,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      {
+        field: metadataConflict.field,
+        admissionValue: metadataConflict.admissionValue,
+        proposalValue: metadataConflict.proposalValue
+      }
+    );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: metadataConflict.code,
+      message: metadataConflict.message
+    });
+    return;
+  }
+  const stale = staleRevision(proposal, admission, workItem);
+  if (stale !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `stale:${admission.admissionId}:${stale.kind}:${stale.expected}:${stale.current}`,
+      stale.kind,
+      `Admission '${admission.admissionId}' targets stale WorkItem revision`,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      { expected: stale.expected, current: stale.current }
+    );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: stale.kind,
+      message: "Stale WorkItem revision"
+    });
+    return;
+  }
+  const policyResult = selectApplyPolicy(state, proposal, admission);
+  if (typeof policyResult === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `policy:${admission.admissionId}:${policyResult}`,
+      policyResult,
+      applyPolicyMessage(policyResult, proposal, admission),
+      admission.workItemId,
+      admissionRefs(admission, proposal)
+    );
+    return;
+  }
+  const output = lowerAction(ctx, state, workItem, proposal, admission, policyResult);
+  if (output === void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: "invalid-action",
+      message: "WorkItem domain action application rejected; see emitted issues",
+      policyId: policyResult.policyId
+    });
+    return;
+  }
+  const duplicateFactId = firstDuplicateFactId(state, output.facts);
+  if (duplicateFactId !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `duplicate-authoring-fact:${admission.admissionId}:${duplicateFactId}`,
+      "duplicate-suppressed",
+      `WorkItem domain action application '${admission.admissionId}' would duplicate authoring fact '${duplicateFactId}'`,
+      admission.workItemId,
+      admissionRefs(admission, proposal, policyResult),
+      { eventId: duplicateFactId }
+    );
+    emitApplication(ctx, state, admission, proposal, "duplicate", [], {
+      code: "duplicate-suppressed",
+      message: "Duplicate WorkItem authoring fact suppressed atomically",
+      policyId: policyResult.policyId
+    });
+    return;
+  }
+  state.appliedAdmissions.add(admission.admissionId);
+  for (const fact of output.facts) claimFactId(state, fact.eventId);
+  for (const fact of output.facts) emitApplicationFact(ctx, "authoring-fact", fact);
+  emitApplication(ctx, state, admission, proposal, output.state, output.facts, {
+    code: output.code,
+    message: output.message,
+    policyId: policyResult.policyId
+  });
+}
+function lowerAction(ctx, state, workItem, proposal, admission, policy) {
+  if (!policyAllowsAction(policy, proposal.actionKind)) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `policy-action:${admission.admissionId}:${policy.policyId}:${proposal.actionKind}`,
+      "policy-mismatch",
+      `Apply policy '${policy.policyId}' does not allow actionKind '${proposal.actionKind}'`,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "policy-rejected", facts: [], code: "policy-mismatch" };
+  }
+  if (proposal.actionKind === "patch") {
+    const lowered = lowerPatchAction(ctx, state, workItem, proposal, admission, policy);
+    if (lowered === void 0) return void 0;
+    return { state: "applied", facts: lowered };
+  }
+  if (proposal.actionKind === "mark-verified" || proposal.actionKind === "require-review") {
+    return {
+      state: "proposal-only",
+      facts: [],
+      code: "domain-fact-unimplemented",
+      message: `Action '${proposal.actionKind}' recorded as visible application status only; no WorkItem domain mutation fact was emitted`
+    };
+  }
+  if (proposal.actionKind === "spawn-proposed" || proposal.actionKind === "spawn-child") {
+    return lowerSpawnAction(ctx, state, proposal, admission, policy);
+  }
+  emitApplicationIssue(
+    ctx,
+    state,
+    `unsupported-action:${admission.admissionId}:${proposal.actionKind}`,
+    "unsupported-effect-kind",
+    `Unsupported WorkItem domain actionKind '${proposal.actionKind}'`,
+    proposal.workItemId,
+    admissionRefs(admission, proposal, policy)
+  );
+  return { state: "rejected", facts: [], code: "unsupported-effect-kind" };
+}
+function lowerPatchAction(ctx, state, workItem, proposal, admission, policy) {
+  const payload = normalizePatchPayload(proposal.payload);
+  if (typeof payload === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `invalid-patch:${admission.admissionId}`,
+      "invalid-patch",
+      payload,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return void 0;
+  }
+  const splitPayload = splitDedicatedPatchFields(payload, workItem);
+  const facts = [];
+  if (splitPayload.patch !== void 0) {
+    const invalid = invalidPatchKeys(splitPayload.patch, policy);
+    if (invalid.length > 0) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `invalid-patch-fields:${admission.admissionId}:${invalid.join(",")}`,
+        "invalid-patch",
+        `Patch action uses unsupported fields: ${invalid.join(", ")}`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy),
+        { invalidFields: invalid }
+      );
+      return void 0;
+    }
+    facts.push({
+      kind: "work-item-patched",
+      eventId: splitPayload.eventId ?? `${admission.admissionId}:work-item-patched`,
+      workItemId: workItem.workItemId,
+      patch: splitPayload.patch,
+      executionRelevantFields: splitPayload.executionRelevantFields ?? policy.patch?.executionRelevantFields,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
+    });
+  }
+  if (splitPayload.acceptanceCriteria !== void 0) {
+    if (!allowsAcceptanceCriteria(policy)) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `ac-policy:${admission.admissionId}`,
+        "policy-mismatch",
+        `Apply policy '${policy.policyId}' does not allow acceptance criteria changes`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy)
+      );
+      return void 0;
+    }
+    const issues = validateAcceptanceCriteria(splitPayload.acceptanceCriteria, {
+      workItemId: workItem.workItemId
+    });
+    if (issues.length > 0) {
+      for (const item of issues) emitApplicationFact(ctx, "issue", item);
+      emitApplicationStatus(ctx, state, {
+        state: "rejected",
+        code: issues[0]?.code,
+        message: issues[0]?.message,
+        workItemId: workItem.workItemId,
+        proposalId: proposal.proposalId,
+        admissionId: admission.admissionId,
+        actionKind: proposal.actionKind,
+        sourceRefs: admissionRefs(admission, proposal, policy)
+      });
+      return void 0;
+    }
+    facts.push({
+      kind: "acceptance-criteria-changed",
+      eventId: `${admission.admissionId}:acceptance-criteria-changed`,
+      workItemId: workItem.workItemId,
+      acceptanceCriteria: splitPayload.acceptanceCriteria,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
+    });
+  }
+  if (splitPayload.verificationPlan !== void 0) {
+    if (!allowsVerificationPlan(policy)) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `plan-policy:${admission.admissionId}`,
+        "policy-mismatch",
+        `Apply policy '${policy.policyId}' does not allow verification plan changes`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy)
+      );
+      return void 0;
+    }
+    const issues = validateVerificationPlan(
+      splitPayload.verificationPlan,
+      splitPayload.acceptanceCriteria ?? workItem.acceptanceCriteria ?? [],
+      { workItemId: workItem.workItemId }
+    );
+    if (issues.length > 0) {
+      for (const item of issues) emitApplicationFact(ctx, "issue", item);
+      emitApplicationStatus(ctx, state, {
+        state: "rejected",
+        code: issues[0]?.code,
+        message: issues[0]?.message,
+        workItemId: workItem.workItemId,
+        proposalId: proposal.proposalId,
+        admissionId: admission.admissionId,
+        actionKind: proposal.actionKind,
+        sourceRefs: admissionRefs(admission, proposal, policy)
+      });
+      return void 0;
+    }
+    facts.push({
+      kind: "verification-plan-changed",
+      eventId: `${admission.admissionId}:verification-plan-changed`,
+      workItemId: workItem.workItemId,
+      verificationPlan: splitPayload.verificationPlan,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
+    });
+  }
+  if (facts.length === 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `empty-patch:${admission.admissionId}`,
+      "invalid-patch",
+      "Patch action payload did not contain patch, acceptanceCriteria, or verificationPlan",
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return void 0;
+  }
+  return facts;
+}
+function lowerSpawnAction(ctx, state, proposal, admission, policy) {
+  if (policy.spawn?.create !== true) {
+    return {
+      state: "proposal-only",
+      facts: [],
+      message: "Spawn action remains proposal/admission only without explicit create policy"
+    };
+  }
+  emitApplicationIssue(
+    ctx,
+    state,
+    `spawn-create-policy:${admission.admissionId}:${policy.policyId}`,
+    "policy-mismatch",
+    `Spawn create policy '${policy.policyId}' is incomplete: child creation requires an explicit create/link/idempotency policy surface`,
+    proposal.workItemId,
+    admissionRefs(admission, proposal, policy),
+    {
+      requires: ["linkParent", "idempotencyKey", "maxChildrenPerAdmission", "link-fact-vocabulary"]
+    }
+  );
+  return {
+    state: "proposal-only",
+    facts: [],
+    code: "policy-mismatch",
+    message: "Spawn action remains proposal/admission only until explicit create/link policy is available"
+  };
+}
+function normalizePatchPayload(payload) {
+  if (!isRecord(payload)) return "Patch action payload must be an object";
+  if ("patch" in payload || "acceptanceCriteria" in payload || "verificationPlan" in payload || "executionRelevantFields" in payload) {
+    if ("patch" in payload && payload.patch !== void 0 && !isRecord(payload.patch))
+      return "Patch action payload.patch must be an object";
+    if ("acceptanceCriteria" in payload && payload.acceptanceCriteria !== void 0 && !Array.isArray(payload.acceptanceCriteria))
+      return "Patch action payload.acceptanceCriteria must be an array";
+    if ("verificationPlan" in payload && payload.verificationPlan !== void 0 && !isRecord(payload.verificationPlan))
+      return "Patch action payload.verificationPlan must be an object";
+    const inlinePatch = inlinePatchFields(payload);
+    const explicitPatch = isRecord(payload.patch) ? payload.patch : void 0;
+    const patch = explicitPatch === void 0 ? inlinePatch : { ...inlinePatch, ...explicitPatch };
+    return {
+      ...payload,
+      patch: Object.keys(patch).length === 0 ? void 0 : patch
+    };
+  }
+  return { patch: payload };
+}
+function inlinePatchFields(payload) {
+  const patch = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (key === "metadata") continue;
+    if (patchFieldKeys.has(key)) patch[key] = value;
+  }
+  return patch;
+}
+function splitDedicatedPatchFields(payload, workItem) {
+  if (!isRecord(payload.patch)) return payload;
+  const patchRecord = payload.patch;
+  const patch = {};
+  for (const [key, value] of Object.entries(patchRecord)) {
+    if (key === "acceptanceCriteria" || key === "verificationPlan" || key === "verificationSteps")
+      continue;
+    patch[key] = value;
+  }
+  const acceptanceCriteria = payload.acceptanceCriteria ?? (Array.isArray(patchRecord.acceptanceCriteria) ? patchRecord.acceptanceCriteria : void 0);
+  const verificationPlan = payload.verificationPlan ?? (isRecord(patchRecord.verificationPlan) ? patchRecord.verificationPlan : Array.isArray(patchRecord.verificationSteps) ? {
+    ...workItem.verificationPlan ?? { planId: "default" },
+    steps: patchRecord.verificationSteps
+  } : void 0);
+  return {
+    ...payload,
+    patch: Object.keys(patch).length === 0 ? void 0 : patch,
+    acceptanceCriteria,
+    verificationPlan
+  };
+}
+function invalidPatchKeys(patch, policy) {
+  const allowed = new Set(policy.patch?.allowedFields ?? Array.from(patchFieldKeys));
+  return Object.keys(patch).filter((key) => !patchFieldKeys.has(key) || !allowed.has(key));
+}
+function allowsAcceptanceCriteria(policy) {
+  if (policy.patch?.allowAcceptanceCriteria === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("acceptanceCriteria") || policy.patch?.allowAcceptanceCriteria === true;
+}
+function allowsVerificationPlan(policy) {
+  if (policy.patch?.allowVerificationPlan === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("verificationPlan") || allowed.includes("verificationSteps") || policy.patch?.allowVerificationPlan === true;
+}
+function selectApplyPolicy(state, proposal, admission) {
+  const explicitId = explicitApplyPolicyId(proposal, admission);
+  if (explicitId !== void 0)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-apply-policy";
+  const matching = Array.from(state.policies.values()).filter(
+    (policy) => policyAllowsAction(policy, proposal.actionKind)
+  );
+  if (matching.length === 0) return "missing-policy";
+  if (matching.length > 1) return "policy-mismatch";
+  return matching[0];
+}
+function explicitApplyPolicyId(proposal, admission) {
+  const metadataPolicy = stringMetadata(admission.metadata, "applyPolicyId") ?? stringMetadata(proposal.metadata, "applyPolicyId");
+  if (metadataPolicy !== void 0) return metadataPolicy;
+  return [...admission.sourceRefs ?? [], ...proposal.sourceRefs ?? []].find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-apply-policy"
+  )?.id;
+}
+function policyAllowsAction(policy, actionKind) {
+  return policy.actionKinds === void 0 || policy.actionKinds.includes(actionKind);
+}
+function admissionProposalMismatch(admission, proposal) {
+  if (admission.workItemId !== proposal.workItemId)
+    return {
+      field: "workItemId",
+      admissionValue: admission.workItemId,
+      proposalValue: proposal.workItemId,
+      message: `Admission '${admission.admissionId}' workItemId does not match proposal '${proposal.proposalId}'`
+    };
+  if (admission.actionKind !== proposal.actionKind)
+    return {
+      field: "actionKind",
+      admissionValue: admission.actionKind,
+      proposalValue: proposal.actionKind,
+      message: `Admission '${admission.admissionId}' actionKind does not match proposal '${proposal.proposalId}'`
+    };
+  return void 0;
+}
+function conflictingApplicationMetadata(proposal, admission) {
+  const authoringRevision = conflictingMetadataNumber(proposal, admission, "authoringRevision");
+  if (authoringRevision !== void 0)
+    return {
+      field: "authoringRevision",
+      code: "stale-revision",
+      ...authoringRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting authoringRevision metadata`
+    };
+  const executionInputRevision = conflictingMetadataNumber(
+    proposal,
+    admission,
+    "executionInputRevision"
+  );
+  if (executionInputRevision !== void 0)
+    return {
+      field: "executionInputRevision",
+      code: "stale-execution-input",
+      ...executionInputRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting executionInputRevision metadata`
+    };
+  const applyPolicyId = conflictingMetadataString(proposal, admission, "applyPolicyId");
+  if (applyPolicyId !== void 0)
+    return {
+      field: "applyPolicyId",
+      code: "policy-mismatch",
+      ...applyPolicyId,
+      message: `Admission '${admission.admissionId}' carries conflicting applyPolicyId metadata`
+    };
+  return void 0;
+}
+function conflictingMetadataNumber(proposal, admission, key) {
+  const proposalValue = numberMetadata(proposal.metadata, key);
+  const admissionValue = numberMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function conflictingMetadataString(proposal, admission, key) {
+  const proposalValue = stringMetadata(proposal.metadata, key);
+  const admissionValue = stringMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function staleRevision(proposal, admission, workItem) {
+  const authoringRevision = numberMetadata(admission.metadata, "authoringRevision") ?? numberMetadata(proposal.metadata, "authoringRevision");
+  if (authoringRevision !== void 0 && authoringRevision !== workItem.authoringRevision)
+    return {
+      kind: "stale-revision",
+      expected: authoringRevision,
+      current: workItem.authoringRevision
+    };
+  const executionInputRevision = numberMetadata(admission.metadata, "executionInputRevision") ?? numberMetadata(proposal.metadata, "executionInputRevision");
+  if (executionInputRevision !== void 0 && executionInputRevision !== workItem.executionInputRevision)
+    return {
+      kind: "stale-execution-input",
+      expected: executionInputRevision,
+      current: workItem.executionInputRevision
+    };
+  return void 0;
+}
+function applyPolicyMessage(code, proposal, admission) {
+  if (code === "missing-policy")
+    return `Admitted action '${admission.admissionId}' requires an explicit apply policy`;
+  if (code === "unknown-work-item-domain-action-apply-policy")
+    return `Admitted action '${admission.admissionId}' references a missing apply policy`;
+  return `Admitted action '${proposal.proposalId}' matches multiple apply policies`;
+}
+function emitApplication(ctx, state, admission, proposal, applicationState, facts, opts = {}) {
+  const producedFactIds = facts.map((fact) => fact.eventId);
+  const application = {
+    kind: "work-item-domain-action-application",
+    applicationId: `${admission.admissionId}:application`,
+    admissionId: admission.admissionId,
+    proposalId: proposal.proposalId,
+    workItemId: proposal.workItemId,
+    actionKind: proposal.actionKind,
+    state: applicationState,
+    producedFactIds,
+    reason: admission.reason ?? proposal.reason,
+    sourceRefs: admissionRefs(admission, proposal),
+    metadata: { policyId: opts.policyId, code: opts.code }
+  };
+  emitApplicationFact(ctx, "application", application);
+  emitApplicationStatus(ctx, state, {
+    state: applicationState,
+    code: opts.code,
+    message: opts.message,
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    admissionId: admission.admissionId,
+    actionKind: proposal.actionKind,
+    sourceRefs: application.sourceRefs,
+    metadata: { producedFactIds, policyId: opts.policyId }
+  });
+}
+function emitApplicationIssue(ctx, state, key, code, message, workItemId, sourceRefs2, metadata) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  const item = dataIssue(code, message, { subjectId: workItemId, refs: sourceRefs2, metadata });
+  emitApplicationFact(ctx, "issue", item);
+  emitApplicationStatus(ctx, state, {
+    state: code === "missing-policy" ? "missing-policy" : "rejected",
+    code,
+    message,
+    workItemId,
+    sourceRefs: sourceRefs2,
+    metadata
+  });
+}
+function emitIntakeStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-intake-status:${state.statusSeq}`,
+    ...status
+  };
+  emitIntake(ctx, "status", statusFact);
+  emitIntakeAudit(ctx, state, "work-item-domain-action-intake-status", statusFact);
+}
+function emitApplicationStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-application-status:${state.statusSeq}`,
+    ...status
+  };
+  emitApplicationFact(ctx, "status", statusFact);
+  emitApplicationAudit(ctx, state, "work-item-domain-action-application-status", statusFact);
+}
+function emitIntakeAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitIntake(ctx, "audit", auditRecord(kind, state.auditSeq, status));
+}
+function emitApplicationAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitApplicationFact(ctx, "audit", auditRecord(kind, state.auditSeq, status));
+}
+function auditRecord(kind, seq, status) {
+  return {
+    id: `${kind}:${seq}`,
+    kind,
+    subjectId: status.workItemId,
+    message: status.message,
+    issueCode: status.code,
+    sourceRefs: status.sourceRefs,
+    metadata: {
+      statusId: status.statusId,
+      state: status.state,
+      proposalId: status.proposalId,
+      admissionId: status.admissionId,
+      actionKind: status.actionKind,
+      ...status.metadata ?? {}
+    }
+  };
+}
+function emitIntake(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+function emitApplicationFact(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+function project(graph, runtime, name, factory, select) {
+  return graph.node(
+    [runtime],
+    (ctx) => {
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const selected = select(raw);
+        if (selected !== void 0) ctx.down([["DATA", selected]]);
+      }
+    },
+    { name, factory, partial: true, completeWhenDepsComplete: false, errorWhenDepsError: false }
+  );
+}
+function firstDuplicateFactId(state, facts) {
+  const pending = /* @__PURE__ */ new Set();
+  for (const fact of facts) {
+    if (state.emittedFactIds.has(fact.eventId) || pending.has(fact.eventId)) return fact.eventId;
+    pending.add(fact.eventId);
+  }
+  return void 0;
+}
+function claimFactId(state, factId) {
+  if (state.emittedFactIds.has(factId)) return false;
+  state.emittedFactIds.add(factId);
+  return true;
+}
+function admissionRefs(admission, proposal, policy) {
+  return uniqueSourceRefs([
+    ref("work-item-domain-action-admission", admission.admissionId),
+    ref("work-item-domain-action-proposal", admission.proposalId),
+    ...proposal === void 0 ? [] : [
+      ref("work-item", proposal.workItemId),
+      ref("work-item-evidence", proposal.evidenceId),
+      ...proposal.sourceRefs ?? []
+    ],
+    ...policy === void 0 ? [] : [ref("work-item-domain-action-apply-policy", policy.policyId)],
+    ...admission.sourceRefs ?? []
+  ]);
+}
+function actionSourceRefs(admission, proposal, policy) {
+  return admissionRefs(admission, proposal, policy);
+}
+function dataIssue(code, message, opts = {}) {
+  return {
+    kind: "issue",
+    code,
+    message,
+    severity: "error",
+    source: "work-item-actions",
+    subjectId: opts.subjectId,
+    refs: opts.refs?.map((sourceRef) => `${sourceRef.kind}:${sourceRef.id}`),
+    metadata: opts.metadata
+  };
+}
+function uniqueSourceRefs(sourceRefs2) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sourceRef of sourceRefs2) {
+    const key = `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(sourceRef);
+  }
+  return out;
+}
+function sourceRefs(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
+}
+function numberMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "number" ? value : void 0;
+}
+function stringMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "string" ? value : void 0;
+}
+function ref(kind, id) {
+  return { kind, id };
+}
+function recordString(value, key) {
+  return isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
+export {
+  workItemDomainActionAdmissionProjector,
+  workItemDomainActionApplicationProjector,
+  workItemDomainActionApplyPolicy,
+  workItemDomainActionCapabilityGuardProjector,
+  workItemDomainActionProposal,
+  workItemDomainActionProposalIntake,
+  workItemDomainActionProposalIntakeProjector
+};
+//# sourceMappingURL=actions.js.map