@graphrefly/ts 0.0.0 → 0.0.2

package/dist/solutions/work-item/actions.cjs

@@ -0,0 +1,2345 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/solutions/work-item/actions.ts
+var actions_exports = {};
+__export(actions_exports, {
+  workItemDomainActionAdmissionProjector: () => workItemDomainActionAdmissionProjector,
+  workItemDomainActionApplicationProjector: () => workItemDomainActionApplicationProjector,
+  workItemDomainActionApplyPolicy: () => workItemDomainActionApplyPolicy,
+  workItemDomainActionCapabilityGuardProjector: () => workItemDomainActionCapabilityGuardProjector,
+  workItemDomainActionProposal: () => workItemDomainActionProposal,
+  workItemDomainActionProposalIntake: () => workItemDomainActionProposalIntake,
+  workItemDomainActionProposalIntakeProjector: () => workItemDomainActionProposalIntakeProjector
+});
+module.exports = __toCommonJS(actions_exports);
+
+// src/protocol/messages.ts
+var SENTINEL = void 0;
+
+// src/ctx/types.ts
+function depWaves(ctx, depIndex) {
+  return ctx.waveData[depIndex] ?? [];
+}
+function depBatch(ctx, depIndex) {
+  const waves = depWaves(ctx, depIndex);
+  if (waves.length === 0) return null;
+  const flattened = waves.flat().filter((v) => v !== SENTINEL);
+  return flattened.length === 0 ? [] : flattened;
+}
+
+// src/orchestration/work-item-runtime-shared.ts
+function emitWorkItemAdmissionIssue(ctx, state, key, code, message, subjectId, sourceRefs2) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  state.issueSeq += 1;
+  state.statusSeq += 1;
+  state.auditSeq += 1;
+  const issue2 = dataIssue(code, message, { subjectId, refs: sourceRefs2 });
+  const status = {
+    kind: "work-item-status",
+    statusId: `${subjectId ?? "work-item"}:mapping-issue:${state.statusSeq}`,
+    workItemId: subjectId ?? "unknown",
+    state: "mapping-issue",
+    sourceRefs: sourceRefs2,
+    issues: [issue2]
+  };
+  const audit = {
+    id: `${subjectId ?? "work-item"}:${code}:${state.auditSeq}`,
+    kind: "work-item-domain-action-admission-issue",
+    subjectId,
+    issueCode: code,
+    message,
+    sourceRefs: sourceRefs2
+  };
+  ctx.down([
+    ["DATA", { kind: "issue", issue: issue2 }],
+    ["DATA", { kind: "status", status }],
+    ["DATA", { kind: "audit", audit }]
+  ]);
+}
+function emptyWorkItemDomainActionAdmissionState() {
+  return {
+    proposals: /* @__PURE__ */ new Map(),
+    policies: /* @__PURE__ */ new Map(),
+    decisions: /* @__PURE__ */ new Map(),
+    admissionsById: /* @__PURE__ */ new Map(),
+    admissionsByProposal: /* @__PURE__ */ new Map(),
+    terminalDecisionIds: /* @__PURE__ */ new Set(),
+    issueKeys: /* @__PURE__ */ new Set(),
+    statusSeq: 0,
+    issueSeq: 0,
+    auditSeq: 0
+  };
+}
+function freezeWorkItemDomainActionAdmissionViews(state) {
+  return {
+    admissionsByProposal: new Map(state.admissionsByProposal),
+    admissionsByWorkItem: new Map(
+      Array.from(state.admissionsByWorkItem, ([key, value]) => [key, Object.freeze([...value])])
+    ),
+    issues: Object.freeze([...state.issues]),
+    audit: Object.freeze([...state.audit])
+  };
+}
+function workItemAdmissionProposalRefs(proposal) {
+  return uniqueSourceRefs([
+    ref("work-item", proposal.workItemId),
+    ref("work-item-domain-action-proposal", proposal.proposalId),
+    ref("effect-run", proposal.effectRunId),
+    ref("effect-run-result", proposal.effectRunResultId),
+    ref("work-item-evidence", proposal.evidenceId),
+    ref("work-item-effect-mapping-policy", proposal.policyId),
+    ...proposal.sourceRefs ?? []
+  ]);
+}
+function workItemAdmissionDecisionRefs(decision, proposal, policy) {
+  return uniqueSourceRefs([
+    ...proposal === void 0 ? [] : workItemAdmissionProposalRefs(proposal),
+    ref("work-item-domain-action-admission-decision", decision.decisionId),
+    ref("work-item-domain-action-admission", decision.admissionId),
+    ref("work-item-domain-action-proposal", decision.proposalId),
+    ...decision.policyId === void 0 ? [] : [ref("work-item-domain-action-admission-policy", decision.policyId)],
+    ...policy === void 0 ? [] : [ref("work-item-domain-action-admission-policy", policy.policyId)],
+    ...decision.targetProposalId === void 0 ? [] : [ref("work-item-domain-action-proposal", decision.targetProposalId)],
+    ...decision.targetAdmissionId === void 0 ? [] : [ref("work-item-domain-action-admission", decision.targetAdmissionId)],
+    ...decision.sourceRefs ?? []
+  ]);
+}
+function uniqueSourceRefs(sourceRefs2) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const sourceRef of sourceRefs2) {
+    const key = sourceRefKey(sourceRef);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(sourceRef);
+  }
+  return unique;
+}
+function sourceRefKey(sourceRef) {
+  return `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+}
+function projectRuntimeFact(graph, runtime, name, factory, pick) {
+  return graph.node(
+    [runtime],
+    (ctx) => {
+      for (const fact of depBatch(ctx, 0) ?? []) {
+        const typed = fact;
+        const value = pick(typed);
+        if (value !== void 0) ctx.down([["DATA", value]]);
+      }
+    },
+    { name, factory }
+  );
+}
+function forEachPolicyDepBatch(ctx, start, count, fn) {
+  for (let i = 0; i < count; i += 1) {
+    for (const value of depBatch(ctx, start + i) ?? []) fn(value);
+  }
+}
+function dataIssue(code, message, opts = {}) {
+  return {
+    kind: "issue",
+    code,
+    message,
+    severity: opts.severity ?? "error",
+    subjectId: opts.subjectId,
+    refs: opts.refs?.map((r) => `${r.kind}:${r.id}`),
+    details: opts.details
+  };
+}
+function ref(kind, id) {
+  return { kind, id };
+}
+
+// src/orchestration/work-item-runtime-admission.ts
+function workItemDomainActionAdmissionProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionAdmissions";
+  const policyDeps = opts.admissionPolicies ?? [];
+  const policyStart = 2;
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    [opts.proposals, opts.decisions, ...policyDeps],
+    (ctx) => {
+      const state = ctx.state.get() ?? emptyWorkItemDomainActionAdmissionState();
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposal = raw;
+        if (state.proposals.has(proposal.proposalId)) {
+          emitWorkItemAdmissionIssue(
+            ctx,
+            state,
+            `duplicate-admission-proposal:${proposal.proposalId}`,
+            "duplicate-work-item-domain-action-proposal",
+            `WorkItemDomainActionProposal '${proposal.proposalId}' was already seen by the admission projector`,
+            proposal.workItemId,
+            workItemAdmissionProposalRefs(proposal)
+          );
+          continue;
+        }
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      forEachPolicyDepBatch(ctx, policyStart, policyDeps.length, (raw) => {
+        const policy = raw;
+        state.policies.set(policy.policyId, policy);
+      });
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const decision = raw;
+        if (state.decisions.has(decision.decisionId)) {
+          emitWorkItemAdmissionIssue(
+            ctx,
+            state,
+            `duplicate-admission-decision:${decision.decisionId}`,
+            "duplicate-work-item-domain-action-admission-decision",
+            `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' was already seen by the admission projector`,
+            decision.proposalId,
+            workItemAdmissionDecisionRefs(decision)
+          );
+          continue;
+        }
+        state.decisions.set(decision.decisionId, decision);
+      }
+      evaluateWorkItemDomainActionAdmissions(ctx, state, now());
+      ctx.state.set(state);
+    },
+    { name: `${name}/runtime`, factory: "workItemDomainActionAdmissionProjector", partial: true }
+  );
+  return {
+    admissions: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/admissions`,
+      "workItemDomainActionAdmissions",
+      (fact) => fact.kind === "admission" ? fact.admission : void 0
+    ),
+    status: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionAdmissionStatus",
+      (fact) => fact.kind === "status" ? fact.status : void 0
+    ),
+    issues: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionAdmissionIssues",
+      (fact) => fact.kind === "issue" ? fact.issue : void 0
+    ),
+    audit: projectRuntimeFact(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAdmissionAudit",
+      (fact) => fact.kind === "audit" ? fact.audit : void 0
+    ),
+    views: graph.node(
+      [runtime],
+      (ctx) => {
+        const state = ctx.state.get() ?? {
+          admissionsByProposal: /* @__PURE__ */ new Map(),
+          admissionsByWorkItem: /* @__PURE__ */ new Map(),
+          issues: [],
+          audit: []
+        };
+        for (const raw of depBatch(ctx, 0) ?? []) {
+          const fact = raw;
+          if (fact.kind === "admission") {
+            const admission = fact.admission;
+            state.admissionsByProposal.set(admission.proposalId, admission);
+            const byWorkItem = state.admissionsByWorkItem.get(admission.workItemId) ?? [];
+            byWorkItem.push(admission);
+            state.admissionsByWorkItem.set(admission.workItemId, byWorkItem);
+          } else if (fact.kind === "issue") state.issues.push(fact.issue);
+          else if (fact.kind === "audit") state.audit.push(fact.audit);
+        }
+        ctx.state.set(state);
+        ctx.down([["DATA", freezeWorkItemDomainActionAdmissionViews(state)]]);
+      },
+      { name: `${name}/views`, factory: "workItemDomainActionAdmissionViews" }
+    )
+  };
+}
+function evaluateWorkItemDomainActionAdmissions(ctx, state, admittedAtMs) {
+  let emitted = true;
+  let passes = 0;
+  while (emitted && passes <= state.decisions.size) {
+    emitted = false;
+    passes += 1;
+    for (const decision of state.decisions.values()) {
+      if (state.terminalDecisionIds.has(decision.decisionId)) continue;
+      emitted = evaluateWorkItemDomainActionAdmission(ctx, state, decision, admittedAtMs) || emitted;
+    }
+  }
+}
+function evaluateWorkItemDomainActionAdmission(ctx, state, decision, admittedAtMs) {
+  const proposal = state.proposals.get(decision.proposalId);
+  const proposalRefs = workItemAdmissionDecisionRefs(decision, proposal);
+  const subjectId = proposal?.workItemId ?? decision.proposalId;
+  if (proposal === void 0) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `missing-admission-proposal:${decision.decisionId}:${decision.proposalId}`,
+      "missing-work-item-domain-action-admission-proposal",
+      `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' references missing proposal '${decision.proposalId}'`,
+      subjectId,
+      proposalRefs
+    );
+    return false;
+  }
+  const staleProposalRef = (decision.sourceRefs ?? []).find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-proposal" && sourceRef.id !== decision.proposalId && sourceRef.id !== decision.targetProposalId
+  );
+  if (staleProposalRef !== void 0) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `stale-admission-proposal-ref:${decision.decisionId}:${staleProposalRef.id}`,
+      "stale-work-item-domain-action-admission-proposal-ref",
+      `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' carries stale proposal ref '${staleProposalRef.id}'`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  const policy = admissionPolicyForDecision(state, decision);
+  if (typeof policy === "string") {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `${policy}:${decision.decisionId}:${decision.policyId ?? "missing"}`,
+      policy,
+      admissionPolicyIssueMessage(policy, decision),
+      proposal.workItemId,
+      proposalRefs
+    );
+    if (policy === "stale-work-item-domain-action-admission-policy-ref")
+      state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  if (policy !== void 0) {
+    const policyIssue = validateWorkItemAdmissionPolicy(policy, decision, proposal);
+    if (policyIssue !== void 0) {
+      emitWorkItemAdmissionIssue(
+        ctx,
+        state,
+        `${policyIssue.code}:${decision.decisionId}:${policy.policyId}`,
+        policyIssue.code,
+        policyIssue.message,
+        proposal.workItemId,
+        workItemAdmissionDecisionRefs(decision, proposal, policy)
+      );
+      return false;
+    }
+  }
+  const mergeIssue = validateWorkItemAdmissionMergeTarget(state, decision);
+  if (mergeIssue !== void 0) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `${mergeIssue.code}:${decision.decisionId}:${decision.targetProposalId ?? ""}:${decision.targetAdmissionId ?? ""}`,
+      mergeIssue.code,
+      mergeIssue.message,
+      proposal.workItemId,
+      proposalRefs
+    );
+    if (mergeIssue.code !== "unknown-work-item-domain-action-admission-merge-target")
+      state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  if (state.admissionsById.has(decision.admissionId)) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `duplicate-admission-id:${decision.admissionId}`,
+      "duplicate-work-item-domain-action-admission",
+      `WorkItemDomainActionAdmission '${decision.admissionId}' was already emitted`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  if (state.admissionsByProposal.has(decision.proposalId)) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `duplicate-admission-proposal-decision:${decision.proposalId}:${decision.decisionId}`,
+      "duplicate-work-item-domain-action-admission-proposal",
+      `WorkItemDomainActionProposal '${decision.proposalId}' already has an admission decision`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  const admissionState = admissionStateForOutcome(decision.outcome);
+  if (admissionState === void 0) {
+    emitWorkItemAdmissionIssue(
+      ctx,
+      state,
+      `unsupported-admission-outcome:${decision.decisionId}:${String(decision.outcome)}`,
+      "unsupported-work-item-domain-action-admission-outcome",
+      `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' uses unsupported outcome '${String(decision.outcome)}'`,
+      proposal.workItemId,
+      proposalRefs
+    );
+    state.terminalDecisionIds.add(decision.decisionId);
+    return false;
+  }
+  const admission = {
+    kind: "work-item-domain-action-admission",
+    admissionId: decision.admissionId,
+    proposalId: proposal.proposalId,
+    workItemId: proposal.workItemId,
+    actionKind: proposal.actionKind,
+    state: admissionState,
+    decisionId: decision.decisionId,
+    policyId: decision.policyId,
+    reason: decision.reason,
+    targetProposalId: decision.targetProposalId,
+    targetAdmissionId: decision.targetAdmissionId,
+    sourceRefs: workItemAdmissionDecisionRefs(decision, proposal, policy),
+    admittedAtMs: decision.decidedAtMs ?? admittedAtMs,
+    metadata: {
+      ...proposal.metadata ?? {},
+      ...policy?.metadata ?? {},
+      ...decision.metadata ?? {}
+    }
+  };
+  state.admissionsById.set(admission.admissionId, admission);
+  state.admissionsByProposal.set(admission.proposalId, admission);
+  state.terminalDecisionIds.add(decision.decisionId);
+  state.statusSeq += 1;
+  state.auditSeq += 1;
+  const statusState = workItemAdmissionStatusState(admission.state);
+  const status = {
+    kind: "work-item-status",
+    statusId: `${proposal.workItemId}:${statusState}:${state.statusSeq}`,
+    workItemId: proposal.workItemId,
+    state: statusState,
+    sourceRefs: admission.sourceRefs,
+    effectRunId: proposal.effectRunId,
+    evidenceId: proposal.evidenceId,
+    proposalId: proposal.proposalId,
+    metadata: {
+      actionKind: proposal.actionKind,
+      admissionId: admission.admissionId,
+      decisionId: decision.decisionId,
+      policyId: decision.policyId
+    }
+  };
+  const audit = {
+    id: `${proposal.workItemId}:${statusState}:${state.auditSeq}`,
+    kind: `work-item-domain-action-${admission.state}`,
+    subjectId: proposal.workItemId,
+    sourceRefs: admission.sourceRefs,
+    metadata: {
+      actionKind: proposal.actionKind,
+      admissionId: admission.admissionId,
+      decisionId: decision.decisionId,
+      policyId: decision.policyId,
+      proposalId: proposal.proposalId
+    }
+  };
+  ctx.down([
+    ["DATA", { kind: "admission", admission }],
+    ["DATA", { kind: "status", status }],
+    ["DATA", { kind: "audit", audit }]
+  ]);
+  return true;
+}
+function admissionPolicyForDecision(state, decision) {
+  if (decision.policyId === void 0) return void 0;
+  const stalePolicyRef = (decision.sourceRefs ?? []).find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-admission-policy" && sourceRef.id !== decision.policyId
+  );
+  if (stalePolicyRef !== void 0) return "stale-work-item-domain-action-admission-policy-ref";
+  return state.policies.get(decision.policyId) ?? "missing-work-item-domain-action-admission-policy";
+}
+function admissionPolicyIssueMessage(code, decision) {
+  if (code === "missing-work-item-domain-action-admission-policy") {
+    return `WorkItemDomainActionAdmissionPolicy '${decision.policyId}' was referenced for WorkItem action admission but not present`;
+  }
+  return `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' carries a stale admission policy source ref`;
+}
+function validateWorkItemAdmissionPolicy(policy, decision, proposal) {
+  if (policy.actionKinds !== void 0 && !policy.actionKinds.includes(proposal.actionKind)) {
+    return {
+      code: "work-item-domain-action-admission-policy-mismatch",
+      message: `WorkItemDomainActionAdmissionPolicy '${policy.policyId}' does not apply to actionKind '${proposal.actionKind}'`
+    };
+  }
+  if (policy.allowedOutcomes !== void 0 && !policy.allowedOutcomes.includes(decision.outcome)) {
+    return {
+      code: "unsupported-work-item-domain-action-admission-outcome",
+      message: `WorkItemDomainActionAdmissionPolicy '${policy.policyId}' does not allow outcome '${decision.outcome}'`
+    };
+  }
+  return void 0;
+}
+function validateWorkItemAdmissionMergeTarget(state, decision) {
+  const hasTargetProposal = decision.targetProposalId !== void 0;
+  const hasTargetAdmission = decision.targetAdmissionId !== void 0;
+  if (decision.outcome !== "merge") {
+    if (hasTargetProposal || hasTargetAdmission) {
+      return {
+        code: "ambiguous-work-item-domain-action-admission-merge-target",
+        message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' carries a merge target for non-merge outcome '${decision.outcome}'`
+      };
+    }
+    return void 0;
+  }
+  if (hasTargetProposal === hasTargetAdmission) {
+    return {
+      code: "ambiguous-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' must reference exactly one merge target`
+    };
+  }
+  if (decision.targetProposalId === decision.proposalId) {
+    return {
+      code: "ambiguous-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' cannot merge a proposal into itself`
+    };
+  }
+  if (decision.targetProposalId !== void 0 && !state.proposals.has(decision.targetProposalId)) {
+    return {
+      code: "unknown-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' references unknown target proposal '${decision.targetProposalId}'`
+    };
+  }
+  if (decision.targetAdmissionId !== void 0 && !state.admissionsById.has(decision.targetAdmissionId)) {
+    return {
+      code: "unknown-work-item-domain-action-admission-merge-target",
+      message: `WorkItemDomainActionAdmissionDecision '${decision.decisionId}' references unknown target admission '${decision.targetAdmissionId}'`
+    };
+  }
+  return void 0;
+}
+function admissionStateForOutcome(outcome) {
+  if (outcome === "admit") return "admitted";
+  if (outcome === "reject") return "rejected";
+  if (outcome === "defer") return "deferred";
+  if (outcome === "merge") return "merged";
+  return void 0;
+}
+function workItemAdmissionStatusState(state) {
+  if (state === "admitted") return "domain-action-admitted";
+  if (state === "rejected") return "domain-action-rejected";
+  if (state === "deferred") return "domain-action-deferred";
+  return "domain-action-merged";
+}
+
+// src/solutions/work-item/actions-shared.ts
+function auditRecord(kind, seq, status) {
+  return {
+    id: `${kind}:${seq}`,
+    kind,
+    subjectId: status.workItemId,
+    message: status.message,
+    issueCode: status.code,
+    sourceRefs: status.sourceRefs,
+    metadata: {
+      statusId: status.statusId,
+      state: status.state,
+      proposalId: status.proposalId,
+      admissionId: status.admissionId,
+      actionKind: status.actionKind,
+      ...status.metadata ?? {}
+    }
+  };
+}
+function project(graph, runtime, name, factory, select) {
+  return graph.node(
+    [runtime],
+    (ctx) => {
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const selected = select(raw);
+        if (selected !== void 0) ctx.down([["DATA", selected]]);
+      }
+    },
+    { name, factory, partial: true, completeWhenDepsComplete: false, errorWhenDepsError: false }
+  );
+}
+function dataIssue2(code, message, opts = {}) {
+  return {
+    kind: "issue",
+    code,
+    message,
+    severity: "error",
+    source: "work-item-actions",
+    subjectId: opts.subjectId,
+    refs: opts.refs?.map((sourceRef) => `${sourceRef.kind}:${sourceRef.id}`),
+    metadata: opts.metadata
+  };
+}
+function uniqueSourceRefs2(sourceRefs2) {
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const sourceRef of sourceRefs2) {
+    const key = `${sourceRef.kind}:${sourceRef.id}:${JSON.stringify(sourceRef.metadata ?? {})}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(sourceRef);
+  }
+  return out;
+}
+function sourceRefs(value) {
+  if (!Array.isArray(value)) return void 0;
+  return value.filter(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
+}
+function numberMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "number" ? value : void 0;
+}
+function stringMetadata(metadata, key) {
+  const value = metadata?.[key];
+  return typeof value === "string" ? value : void 0;
+}
+function ref2(kind, id) {
+  return { kind, id };
+}
+function recordString(value, key) {
+  return isRecord(value) && typeof value[key] === "string" ? value[key] : void 0;
+}
+function isRecord(value) {
+  return value !== null && typeof value === "object";
+}
+
+// src/solutions/work-item/actions-types.ts
+var patchFieldKeys = /* @__PURE__ */ new Set([
+  "summary",
+  "detail",
+  "detailRefs",
+  "kind",
+  "priority",
+  "tags",
+  "owner",
+  "assignee",
+  "deadlineMs",
+  "customFields",
+  "sourceRefs",
+  "metadata"
+]);
+
+// src/solutions/work-item/scheduling-shared.ts
+function normalizePlanFromUnknown(draft) {
+  const verificationPlan = draft.verificationPlan;
+  if (verificationPlan !== void 0) {
+    if (!isRecord2(verificationPlan) || !Array.isArray(verificationPlan.steps)) {
+      return { planId: "malformed", steps: [] };
+    }
+    return verificationPlan;
+  }
+  const verificationSteps = draft.verificationSteps;
+  if (verificationSteps !== void 0) {
+    if (!Array.isArray(verificationSteps)) return { planId: "malformed", steps: [] };
+    return { planId: "default", steps: verificationSteps };
+  }
+  return void 0;
+}
+function isVerificationPlanShape(value) {
+  return isRecord2(value) && typeof value.planId === "string" && Array.isArray(value.steps);
+}
+function issue(code, message, workItemId, metadata) {
+  return {
+    kind: "issue",
+    code,
+    message,
+    severity: "error",
+    source: "work-item-scheduling",
+    subjectId: workItemId,
+    metadata
+  };
+}
+function isRecord2(value) {
+  return value !== null && typeof value === "object";
+}
+
+// src/solutions/work-item/scheduling-validation.ts
+function validateWorkItemDraft(draft, opts = {}) {
+  const out = [];
+  if (!isRecord2(draft)) {
+    return [issue("malformed-draft", "WorkItemDraft must be an object", opts.workItemId)];
+  }
+  if (typeof draft.summary !== "string") {
+    out.push(issue("missing-required-field", "WorkItemDraft.summary is required", opts.workItemId));
+  } else if (draft.summary.trim() === "") {
+    out.push(issue("missing-required-field", "WorkItemDraft.summary is required", opts.workItemId));
+  }
+  const criteria = draft.acceptanceCriteria === void 0 || Array.isArray(draft.acceptanceCriteria) ? draft.acceptanceCriteria : void 0;
+  if (draft.acceptanceCriteria !== void 0 && criteria === void 0) {
+    out.push(
+      issue(
+        "malformed-draft",
+        "WorkItemDraft.acceptanceCriteria must be an array",
+        opts.workItemId
+      )
+    );
+  }
+  out.push(...validateAcceptanceCriteria(criteria ?? [], opts));
+  if (draft.verificationPlan !== void 0 && !isVerificationPlanShape(draft.verificationPlan)) {
+    out.push(
+      issue("malformed-draft", "WorkItemDraft.verificationPlan is malformed", opts.workItemId)
+    );
+  }
+  if (draft.verificationSteps !== void 0 && !Array.isArray(draft.verificationSteps)) {
+    out.push(
+      issue("malformed-draft", "WorkItemDraft.verificationSteps must be an array", opts.workItemId)
+    );
+  }
+  const plan = normalizePlanFromUnknown(draft);
+  if (plan !== void 0) {
+    out.push(...validateVerificationPlan(plan, criteria ?? [], opts));
+  }
+  return out;
+}
+function validateAcceptanceCriteria(criteria, opts = {}) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const criterion of criteria) {
+    if (!isRecord2(criterion)) {
+      out.push(issue("malformed-draft", "AcceptanceCriterion must be an object", opts.workItemId));
+      continue;
+    }
+    if (typeof criterion.criterionId !== "string" || criterion.criterionId === "") {
+      out.push(
+        issue(
+          "missing-required-field",
+          "AcceptanceCriterion.criterionId is required",
+          opts.workItemId
+        )
+      );
+      continue;
+    }
+    if (seen.has(criterion.criterionId)) {
+      out.push(
+        issue(
+          "duplicate-id",
+          `Duplicate acceptance criterion id '${criterion.criterionId}'`,
+          opts.workItemId,
+          { criterionId: criterion.criterionId }
+        )
+      );
+    }
+    seen.add(criterion.criterionId);
+    if (typeof criterion.statement !== "string" || criterion.statement.trim() === "") {
+      out.push(
+        issue(
+          "missing-required-field",
+          "AcceptanceCriterion.statement is required",
+          opts.workItemId,
+          { criterionId: criterion.criterionId }
+        )
+      );
+    }
+  }
+  return out;
+}
+function validateVerificationPlan(plan, criteria = [], opts = {}) {
+  const out = [];
+  if (!isRecord2(plan) || !Array.isArray(plan.steps)) {
+    return [issue("malformed-draft", "VerificationPlan.steps must be an array", opts.workItemId)];
+  }
+  const criterionIds = new Set(criteria.map((criterion) => criterion.criterionId));
+  const stepIds = /* @__PURE__ */ new Set();
+  const modes = new Set(opts.allowedModes ?? ["auto", "manual", "hybrid"]);
+  const effectKinds = new Set(opts.allowedEffectKinds ?? ["verification"]);
+  for (const step of plan.steps) {
+    if (!isRecord2(step)) {
+      out.push(issue("malformed-draft", "VerificationStep must be an object", opts.workItemId));
+      continue;
+    }
+    if (typeof step.stepId !== "string" || step.stepId === "") {
+      out.push(
+        issue("missing-required-field", "VerificationStep.stepId is required", opts.workItemId)
+      );
+      continue;
+    }
+    if (stepIds.has(step.stepId)) {
+      out.push(
+        issue("duplicate-id", `Duplicate verification step id '${step.stepId}'`, opts.workItemId, {
+          stepId: step.stepId
+        })
+      );
+    }
+    stepIds.add(step.stepId);
+    if (typeof step.mode !== "string" || !modes.has(step.mode)) {
+      out.push(
+        issue(
+          "unsupported-mode",
+          `Unsupported verification step mode '${step.mode}'`,
+          opts.workItemId,
+          { stepId: step.stepId }
+        )
+      );
+    }
+    if (step.effectKind !== void 0 && (typeof step.effectKind !== "string" || !effectKinds.has(step.effectKind))) {
+      out.push(
+        issue(
+          "unsupported-effect-kind",
+          `Unsupported verification effect kind '${step.effectKind}'`,
+          opts.workItemId,
+          { stepId: step.stepId }
+        )
+      );
+    }
+    const verifiesCriteriaIds = Array.isArray(step.verifiesCriteriaIds) ? step.verifiesCriteriaIds : [];
+    for (const criterionId of verifiesCriteriaIds) {
+      if (!criterionIds.has(criterionId)) {
+        out.push(
+          issue("dangling-ref", `Unknown acceptance criterion '${criterionId}'`, opts.workItemId, {
+            stepId: step.stepId,
+            criterionId
+          })
+        );
+      }
+    }
+  }
+  for (const step of plan.steps) {
+    if (!isRecord2(step) || typeof step.stepId !== "string") continue;
+    const dependsOnStepIds = Array.isArray(step.dependsOnStepIds) ? step.dependsOnStepIds : [];
+    for (const depId of dependsOnStepIds) {
+      if (!stepIds.has(depId)) {
+        out.push(
+          issue("dangling-ref", `Unknown verification dependency '${depId}'`, opts.workItemId, {
+            stepId: step.stepId
+          })
+        );
+      }
+    }
+  }
+  const cycle = findCycle(
+    plan.steps.filter(
+      (step) => isRecord2(step) && typeof step.stepId === "string" && Array.isArray(step.dependsOnStepIds)
+    )
+  );
+  if (cycle !== void 0) {
+    out.push(
+      issue(
+        "cyclic-dependency",
+        `Verification step cycle detected: ${cycle.join(" -> ")}`,
+        opts.workItemId,
+        { stepId: cycle[0] }
+      )
+    );
+  }
+  return out;
+}
+function findCycle(steps) {
+  const byId = new Map(steps.map((step) => [step.stepId, step.dependsOnStepIds ?? []]));
+  const visiting = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new Set();
+  const stack = [];
+  const visit = (id) => {
+    if (visiting.has(id)) return [...stack.slice(stack.indexOf(id)), id];
+    if (visited.has(id)) return void 0;
+    visiting.add(id);
+    stack.push(id);
+    for (const dep of byId.get(id) ?? []) {
+      if (!byId.has(dep)) continue;
+      const cycle = visit(dep);
+      if (cycle !== void 0) return cycle;
+    }
+    stack.pop();
+    visiting.delete(id);
+    visited.add(id);
+    return void 0;
+  };
+  for (const step of steps) {
+    const cycle = visit(step.stepId);
+    if (cycle !== void 0) return cycle;
+  }
+  return void 0;
+}
+
+// src/solutions/work-item/actions-application.ts
+function workItemDomainActionApplicationProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionApplication";
+  const deps = opts.applyPolicies === void 0 ? [opts.proposals, opts.admissions, opts.workItems] : [opts.proposals, opts.admissions, opts.workItems, opts.applyPolicies];
+  const runtime = graph.node(
+    deps,
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Map(),
+        admissions: /* @__PURE__ */ new Map(),
+        workItems: /* @__PURE__ */ new Map(),
+        policies: /* @__PURE__ */ new Map(),
+        appliedAdmissions: /* @__PURE__ */ new Set(),
+        emittedFactIds: /* @__PURE__ */ new Set(),
+        issueKeys: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposal = raw;
+        if (state.proposals.has(proposal.proposalId)) {
+          emitApplicationIssue(
+            ctx,
+            state,
+            `duplicate-proposal:${proposal.proposalId}`,
+            "duplicate-suppressed",
+            `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`,
+            proposal.workItemId,
+            proposal.sourceRefs
+          );
+          continue;
+        }
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      for (const raw of depBatch(ctx, 2) ?? []) {
+        const workItem = raw;
+        state.workItems.set(workItem.workItemId, workItem);
+      }
+      if (opts.applyPolicies !== void 0) {
+        for (const raw of depBatch(ctx, 3) ?? []) {
+          const policy = raw;
+          state.policies.set(policy.policyId, policy);
+        }
+      }
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const admission = raw;
+        if (state.admissions.has(admission.admissionId)) {
+          emitApplicationIssue(
+            ctx,
+            state,
+            `duplicate-admission:${admission.admissionId}`,
+            "duplicate-suppressed",
+            `Duplicate WorkItem domain action admission '${admission.admissionId}' suppressed`,
+            admission.workItemId,
+            admissionRefs(admission)
+          );
+          continue;
+        }
+        state.admissions.set(admission.admissionId, admission);
+      }
+      for (const admission of state.admissions.values()) applyAdmission(ctx, state, admission);
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionApplicationProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    authoringFacts: project(
+      graph,
+      runtime,
+      `${name}/authoringFacts`,
+      "workItemDomainActionAuthoringFacts",
+      (fact) => fact.kind === "authoring-fact" ? fact.value : void 0
+    ),
+    applications: project(
+      graph,
+      runtime,
+      `${name}/applications`,
+      "workItemDomainActionApplications",
+      (fact) => fact.kind === "application" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function applyAdmission(ctx, state, admission) {
+  if (state.appliedAdmissions.has(admission.admissionId)) return;
+  const proposal = state.proposals.get(admission.proposalId);
+  if (proposal === void 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-proposal:${admission.admissionId}:${admission.proposalId}`,
+      "dangling-ref",
+      `Admission '${admission.admissionId}' cannot apply without proposal '${admission.proposalId}'`,
+      admission.workItemId,
+      admissionRefs(admission)
+    );
+    return;
+  }
+  if (admission.state !== "admitted") {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplication(ctx, state, admission, proposal, admission.state, []);
+    return;
+  }
+  const mismatch = admissionProposalMismatch(admission, proposal);
+  if (mismatch !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `admission-proposal-mismatch:${admission.admissionId}:${mismatch.field}`,
+      "dangling-ref",
+      mismatch.message,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      {
+        field: mismatch.field,
+        admissionValue: mismatch.admissionValue,
+        proposalValue: mismatch.proposalValue
+      }
+    );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: "dangling-ref",
+      message: mismatch.message
+    });
+    return;
+  }
+  const workItem = state.workItems.get(admission.workItemId);
+  if (workItem === void 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-work-item:${admission.admissionId}:${admission.workItemId}`,
+      "dangling-ref",
+      `Admission '${admission.admissionId}' references unknown WorkItem '${admission.workItemId}'`,
+      admission.workItemId,
+      admissionRefs(admission, proposal)
+    );
+    return;
+  }
+  const metadataConflict = conflictingApplicationMetadata(proposal, admission);
+  if (metadataConflict !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `metadata-conflict:${admission.admissionId}:${metadataConflict.field}`,
+      metadataConflict.code,
+      metadataConflict.message,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      {
+        field: metadataConflict.field,
+        admissionValue: metadataConflict.admissionValue,
+        proposalValue: metadataConflict.proposalValue
+      }
+    );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: metadataConflict.code,
+      message: metadataConflict.message
+    });
+    return;
+  }
+  const stale = staleRevision(proposal, admission, workItem);
+  if (stale !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `stale:${admission.admissionId}:${stale.kind}:${stale.expected}:${stale.current}`,
+      stale.kind,
+      `Admission '${admission.admissionId}' targets stale WorkItem revision`,
+      admission.workItemId,
+      admissionRefs(admission, proposal),
+      { expected: stale.expected, current: stale.current }
+    );
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: stale.kind,
+      message: "Stale WorkItem revision"
+    });
+    return;
+  }
+  const policyResult = selectApplyPolicy(state, proposal, admission);
+  if (typeof policyResult === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `policy:${admission.admissionId}:${policyResult}`,
+      policyResult,
+      applyPolicyMessage(policyResult, proposal, admission),
+      admission.workItemId,
+      admissionRefs(admission, proposal)
+    );
+    return;
+  }
+  const output = lowerAction(ctx, state, workItem, proposal, admission, policyResult);
+  if (output === void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplication(ctx, state, admission, proposal, "rejected", [], {
+      code: "invalid-action",
+      message: "WorkItem domain action application rejected; see emitted issues",
+      policyId: policyResult.policyId
+    });
+    return;
+  }
+  const duplicateFactId = firstDuplicateFactId(state, output.facts);
+  if (duplicateFactId !== void 0) {
+    state.appliedAdmissions.add(admission.admissionId);
+    emitApplicationIssue(
+      ctx,
+      state,
+      `duplicate-authoring-fact:${admission.admissionId}:${duplicateFactId}`,
+      "duplicate-suppressed",
+      `WorkItem domain action application '${admission.admissionId}' would duplicate authoring fact '${duplicateFactId}'`,
+      admission.workItemId,
+      admissionRefs(admission, proposal, policyResult),
+      { eventId: duplicateFactId }
+    );
+    emitApplication(ctx, state, admission, proposal, "duplicate", [], {
+      code: "duplicate-suppressed",
+      message: "Duplicate WorkItem authoring fact suppressed atomically",
+      policyId: policyResult.policyId
+    });
+    return;
+  }
+  state.appliedAdmissions.add(admission.admissionId);
+  for (const fact of output.facts) claimFactId(state, fact.eventId);
+  for (const fact of output.facts) emitApplicationFact(ctx, "authoring-fact", fact);
+  emitApplication(ctx, state, admission, proposal, output.state, output.facts, {
+    code: output.code,
+    message: output.message,
+    policyId: policyResult.policyId
+  });
+}
+function lowerAction(ctx, state, workItem, proposal, admission, policy) {
+  if (!policyAllowsAction(policy, proposal.actionKind)) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `policy-action:${admission.admissionId}:${policy.policyId}:${proposal.actionKind}`,
+      "policy-mismatch",
+      `Apply policy '${policy.policyId}' does not allow actionKind '${proposal.actionKind}'`,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "policy-rejected", facts: [], code: "policy-mismatch" };
+  }
+  if (proposal.actionKind === "patch") {
+    const lowered = lowerPatchAction(ctx, state, workItem, proposal, admission, policy);
+    if (lowered === void 0) return void 0;
+    return { state: "applied", facts: lowered };
+  }
+  if (proposal.actionKind === "mark-verified" || proposal.actionKind === "require-review") {
+    return {
+      state: "proposal-only",
+      facts: [],
+      code: "domain-fact-unimplemented",
+      message: `Action '${proposal.actionKind}' recorded as visible application status only; no WorkItem domain mutation fact was emitted`
+    };
+  }
+  if (proposal.actionKind === "spawn-proposed" || proposal.actionKind === "spawn-child") {
+    return lowerSpawnAction(ctx, state, proposal, admission, policy);
+  }
+  emitApplicationIssue(
+    ctx,
+    state,
+    `unsupported-action:${admission.admissionId}:${proposal.actionKind}`,
+    "unsupported-effect-kind",
+    `Unsupported WorkItem domain actionKind '${proposal.actionKind}'`,
+    proposal.workItemId,
+    admissionRefs(admission, proposal, policy)
+  );
+  return { state: "rejected", facts: [], code: "unsupported-effect-kind" };
+}
+function lowerPatchAction(ctx, state, workItem, proposal, admission, policy) {
+  const payload = normalizePatchPayload(proposal.payload);
+  if (typeof payload === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `invalid-patch:${admission.admissionId}`,
+      "invalid-patch",
+      payload,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return void 0;
+  }
+  const splitPayload = splitDedicatedPatchFields(payload, workItem);
+  const facts = [];
+  if (splitPayload.patch !== void 0) {
+    const invalid = invalidPatchKeys(splitPayload.patch, policy);
+    if (invalid.length > 0) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `invalid-patch-fields:${admission.admissionId}:${invalid.join(",")}`,
+        "invalid-patch",
+        `Patch action uses unsupported fields: ${invalid.join(", ")}`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy),
+        { invalidFields: invalid }
+      );
+      return void 0;
+    }
+    facts.push({
+      kind: "work-item-patched",
+      eventId: splitPayload.eventId ?? `${admission.admissionId}:work-item-patched`,
+      workItemId: workItem.workItemId,
+      patch: splitPayload.patch,
+      executionRelevantFields: splitPayload.executionRelevantFields ?? policy.patch?.executionRelevantFields,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
+    });
+  }
+  if (splitPayload.acceptanceCriteria !== void 0) {
+    if (!allowsAcceptanceCriteria(policy)) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `ac-policy:${admission.admissionId}`,
+        "policy-mismatch",
+        `Apply policy '${policy.policyId}' does not allow acceptance criteria changes`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy)
+      );
+      return void 0;
+    }
+    const issues = validateAcceptanceCriteria(splitPayload.acceptanceCriteria, {
+      workItemId: workItem.workItemId
+    });
+    if (issues.length > 0) {
+      for (const item of issues) emitApplicationFact(ctx, "issue", item);
+      emitApplicationStatus(ctx, state, {
+        state: "rejected",
+        code: issues[0]?.code,
+        message: issues[0]?.message,
+        workItemId: workItem.workItemId,
+        proposalId: proposal.proposalId,
+        admissionId: admission.admissionId,
+        actionKind: proposal.actionKind,
+        sourceRefs: admissionRefs(admission, proposal, policy)
+      });
+      return void 0;
+    }
+    facts.push({
+      kind: "acceptance-criteria-changed",
+      eventId: `${admission.admissionId}:acceptance-criteria-changed`,
+      workItemId: workItem.workItemId,
+      acceptanceCriteria: splitPayload.acceptanceCriteria,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
+    });
+  }
+  if (splitPayload.verificationPlan !== void 0) {
+    if (!allowsVerificationPlan(policy)) {
+      emitApplicationIssue(
+        ctx,
+        state,
+        `plan-policy:${admission.admissionId}`,
+        "policy-mismatch",
+        `Apply policy '${policy.policyId}' does not allow verification plan changes`,
+        proposal.workItemId,
+        admissionRefs(admission, proposal, policy)
+      );
+      return void 0;
+    }
+    const issues = validateVerificationPlan(
+      splitPayload.verificationPlan,
+      splitPayload.acceptanceCriteria ?? workItem.acceptanceCriteria ?? [],
+      { workItemId: workItem.workItemId }
+    );
+    if (issues.length > 0) {
+      for (const item of issues) emitApplicationFact(ctx, "issue", item);
+      emitApplicationStatus(ctx, state, {
+        state: "rejected",
+        code: issues[0]?.code,
+        message: issues[0]?.message,
+        workItemId: workItem.workItemId,
+        proposalId: proposal.proposalId,
+        admissionId: admission.admissionId,
+        actionKind: proposal.actionKind,
+        sourceRefs: admissionRefs(admission, proposal, policy)
+      });
+      return void 0;
+    }
+    facts.push({
+      kind: "verification-plan-changed",
+      eventId: `${admission.admissionId}:verification-plan-changed`,
+      workItemId: workItem.workItemId,
+      verificationPlan: splitPayload.verificationPlan,
+      authorId: splitPayload.authorId,
+      sourceRefs: actionSourceRefs(admission, proposal, policy),
+      metadata: { ...splitPayload.metadata ?? {}, actionKind: proposal.actionKind }
+    });
+  }
+  if (facts.length === 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `empty-patch:${admission.admissionId}`,
+      "invalid-patch",
+      "Patch action payload did not contain patch, acceptanceCriteria, or verificationPlan",
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return void 0;
+  }
+  return facts;
+}
+function lowerSpawnAction(ctx, state, proposal, admission, policy) {
+  if (policy.spawn?.create !== true) {
+    return {
+      state: "proposal-only",
+      facts: [],
+      message: "Spawn action remains proposal/admission only without explicit create policy"
+    };
+  }
+  const policyIssue = validateSpawnCreatePolicy(policy, proposal);
+  if (policyIssue !== void 0) {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `spawn-create-policy:${admission.admissionId}:${policy.policyId}:${policyIssue.field}`,
+      "policy-mismatch",
+      policyIssue.message,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy),
+      { field: policyIssue.field }
+    );
+    return {
+      state: "policy-rejected",
+      facts: [],
+      code: "policy-mismatch",
+      message: policyIssue.message
+    };
+  }
+  const payload = normalizeSpawnPayload(proposal.payload);
+  if (typeof payload === "string") {
+    emitApplicationIssue(
+      ctx,
+      state,
+      `invalid-spawn-payload:${admission.admissionId}`,
+      "invalid-patch",
+      payload,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "rejected", facts: [], code: "invalid-patch", message: payload };
+  }
+  const childWorkItemId = payload.childWorkItemId ?? payload.workItemId ?? policy.spawn.childWorkItemId ?? (policy.spawn.childIdPrefix === void 0 ? void 0 : `${policy.spawn.childIdPrefix}${admission.admissionId}`);
+  if (childWorkItemId === void 0 || childWorkItemId.trim() === "") {
+    const message = "Spawn create action requires a childWorkItemId or create policy child id";
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-spawn-child-id:${admission.admissionId}`,
+      "missing-required-field",
+      message,
+      proposal.workItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "rejected", facts: [], code: "missing-required-field", message };
+  }
+  if (state.workItems.has(childWorkItemId)) {
+    const message = `Spawn create action would duplicate WorkItem '${childWorkItemId}'`;
+    emitApplicationIssue(
+      ctx,
+      state,
+      `duplicate-spawn-child:${admission.admissionId}:${childWorkItemId}`,
+      "duplicate-id",
+      message,
+      childWorkItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "duplicate", facts: [], code: "duplicate-id", message };
+  }
+  if (payload.draft === void 0) {
+    const message = "Spawn create action requires a draft payload";
+    emitApplicationIssue(
+      ctx,
+      state,
+      `missing-spawn-draft:${admission.admissionId}`,
+      "missing-required-field",
+      message,
+      childWorkItemId,
+      admissionRefs(admission, proposal, policy)
+    );
+    return { state: "rejected", facts: [], code: "missing-required-field", message };
+  }
+  const issues = validateWorkItemDraft(payload.draft, { workItemId: childWorkItemId });
+  if (issues.length > 0) {
+    for (const item of issues) emitApplicationFact(ctx, "issue", item);
+    return {
+      state: "rejected",
+      facts: [],
+      code: issues[0]?.code,
+      message: issues[0]?.message
+    };
+  }
+  const metadata = {
+    ...payload.metadata ?? {},
+    actionKind: proposal.actionKind,
+    parentWorkItemId: policy.spawn.linkParent === true ? proposal.workItemId : void 0,
+    sourceProposalId: proposal.proposalId,
+    idempotencyKey: payload.idempotencyKey ?? policy.spawn.idempotencyKey
+  };
+  const created = {
+    kind: "work-item-created",
+    eventId: payload.eventId ?? `${admission.admissionId}:work-item-created:${childWorkItemId}`,
+    workItemId: childWorkItemId,
+    draft: payload.draft,
+    authorId: payload.authorId,
+    sourceRefs: actionSourceRefs(admission, proposal, policy),
+    metadata
+  };
+  return { state: "applied", facts: [created] };
+}
+function validateSpawnCreatePolicy(policy, proposal) {
+  if (policy.spawn?.idempotencyKey === void 0 || policy.spawn.idempotencyKey.trim() === "") {
+    return {
+      field: "idempotencyKey",
+      message: `Spawn create policy '${policy.policyId}' requires an idempotencyKey`
+    };
+  }
+  if (policy.spawn.maxChildrenPerAdmission === void 0 || policy.spawn.maxChildrenPerAdmission < 1) {
+    return {
+      field: "maxChildrenPerAdmission",
+      message: `Spawn create policy '${policy.policyId}' requires maxChildrenPerAdmission >= 1`
+    };
+  }
+  if (proposal.actionKind === "spawn-child" && policy.spawn.linkParent !== true) {
+    return {
+      field: "linkParent",
+      message: `Spawn child create policy '${policy.policyId}' requires linkParent: true`
+    };
+  }
+  return void 0;
+}
+function normalizeSpawnPayload(payload) {
+  if (!isRecord(payload)) return "Spawn action payload must be an object";
+  if ("draft" in payload && payload.draft !== void 0 && !isRecord(payload.draft)) {
+    return "Spawn action payload.draft must be an object";
+  }
+  if ("metadata" in payload && payload.metadata !== void 0 && !isRecord(payload.metadata)) {
+    return "Spawn action payload.metadata must be an object";
+  }
+  return payload;
+}
+function normalizePatchPayload(payload) {
+  if (!isRecord(payload)) return "Patch action payload must be an object";
+  if ("patch" in payload || "acceptanceCriteria" in payload || "verificationPlan" in payload || "executionRelevantFields" in payload) {
+    if ("patch" in payload && payload.patch !== void 0 && !isRecord(payload.patch))
+      return "Patch action payload.patch must be an object";
+    if ("acceptanceCriteria" in payload && payload.acceptanceCriteria !== void 0 && !Array.isArray(payload.acceptanceCriteria))
+      return "Patch action payload.acceptanceCriteria must be an array";
+    if ("verificationPlan" in payload && payload.verificationPlan !== void 0 && !isRecord(payload.verificationPlan))
+      return "Patch action payload.verificationPlan must be an object";
+    const inlinePatch = inlinePatchFields(payload);
+    const explicitPatch = isRecord(payload.patch) ? payload.patch : void 0;
+    const patch = explicitPatch === void 0 ? inlinePatch : { ...inlinePatch, ...explicitPatch };
+    return {
+      ...payload,
+      patch: Object.keys(patch).length === 0 ? void 0 : patch
+    };
+  }
+  return { patch: payload };
+}
+function inlinePatchFields(payload) {
+  const patch = {};
+  for (const [key, value] of Object.entries(payload)) {
+    if (key === "metadata") continue;
+    if (patchFieldKeys.has(key)) patch[key] = value;
+  }
+  return patch;
+}
+function splitDedicatedPatchFields(payload, workItem) {
+  if (!isRecord(payload.patch)) return payload;
+  const patchRecord = payload.patch;
+  const patch = {};
+  for (const [key, value] of Object.entries(patchRecord)) {
+    if (key === "acceptanceCriteria" || key === "verificationPlan" || key === "verificationSteps")
+      continue;
+    patch[key] = value;
+  }
+  const acceptanceCriteria = payload.acceptanceCriteria ?? (Array.isArray(patchRecord.acceptanceCriteria) ? patchRecord.acceptanceCriteria : void 0);
+  const verificationPlan = payload.verificationPlan ?? (isRecord(patchRecord.verificationPlan) ? patchRecord.verificationPlan : Array.isArray(patchRecord.verificationSteps) ? {
+    ...workItem.verificationPlan ?? { planId: "default" },
+    steps: patchRecord.verificationSteps
+  } : void 0);
+  return {
+    ...payload,
+    patch: Object.keys(patch).length === 0 ? void 0 : patch,
+    acceptanceCriteria,
+    verificationPlan
+  };
+}
+function invalidPatchKeys(patch, policy) {
+  const allowed = new Set(policy.patch?.allowedFields ?? Array.from(patchFieldKeys));
+  return Object.keys(patch).filter((key) => !patchFieldKeys.has(key) || !allowed.has(key));
+}
+function allowsAcceptanceCriteria(policy) {
+  if (policy.patch?.allowAcceptanceCriteria === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("acceptanceCriteria") || policy.patch?.allowAcceptanceCriteria === true;
+}
+function allowsVerificationPlan(policy) {
+  if (policy.patch?.allowVerificationPlan === false) return false;
+  const allowed = policy.patch?.allowedFields;
+  return allowed === void 0 || allowed.includes("verificationPlan") || allowed.includes("verificationSteps") || policy.patch?.allowVerificationPlan === true;
+}
+function selectApplyPolicy(state, proposal, admission) {
+  const explicitId = explicitApplyPolicyId(proposal, admission);
+  if (explicitId !== void 0)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-apply-policy";
+  const matching = Array.from(state.policies.values()).filter(
+    (policy) => policyAllowsAction(policy, proposal.actionKind)
+  );
+  if (matching.length === 0) return "missing-policy";
+  if (matching.length > 1) return "policy-mismatch";
+  return matching[0];
+}
+function explicitApplyPolicyId(proposal, admission) {
+  const metadataPolicy = stringMetadata(admission.metadata, "applyPolicyId") ?? stringMetadata(proposal.metadata, "applyPolicyId");
+  if (metadataPolicy !== void 0) return metadataPolicy;
+  return [...admission.sourceRefs ?? [], ...proposal.sourceRefs ?? []].find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-apply-policy"
+  )?.id;
+}
+function policyAllowsAction(policy, actionKind) {
+  return policy.actionKinds === void 0 || policy.actionKinds.includes(actionKind);
+}
+function admissionProposalMismatch(admission, proposal) {
+  if (admission.workItemId !== proposal.workItemId)
+    return {
+      field: "workItemId",
+      admissionValue: admission.workItemId,
+      proposalValue: proposal.workItemId,
+      message: `Admission '${admission.admissionId}' workItemId does not match proposal '${proposal.proposalId}'`
+    };
+  if (admission.actionKind !== proposal.actionKind)
+    return {
+      field: "actionKind",
+      admissionValue: admission.actionKind,
+      proposalValue: proposal.actionKind,
+      message: `Admission '${admission.admissionId}' actionKind does not match proposal '${proposal.proposalId}'`
+    };
+  return void 0;
+}
+function conflictingApplicationMetadata(proposal, admission) {
+  const authoringRevision = conflictingMetadataNumber(proposal, admission, "authoringRevision");
+  if (authoringRevision !== void 0)
+    return {
+      field: "authoringRevision",
+      code: "stale-revision",
+      ...authoringRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting authoringRevision metadata`
+    };
+  const executionInputRevision = conflictingMetadataNumber(
+    proposal,
+    admission,
+    "executionInputRevision"
+  );
+  if (executionInputRevision !== void 0)
+    return {
+      field: "executionInputRevision",
+      code: "stale-execution-input",
+      ...executionInputRevision,
+      message: `Admission '${admission.admissionId}' carries conflicting executionInputRevision metadata`
+    };
+  const applyPolicyId = conflictingMetadataString(proposal, admission, "applyPolicyId");
+  if (applyPolicyId !== void 0)
+    return {
+      field: "applyPolicyId",
+      code: "policy-mismatch",
+      ...applyPolicyId,
+      message: `Admission '${admission.admissionId}' carries conflicting applyPolicyId metadata`
+    };
+  return void 0;
+}
+function conflictingMetadataNumber(proposal, admission, key) {
+  const proposalValue = numberMetadata(proposal.metadata, key);
+  const admissionValue = numberMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function conflictingMetadataString(proposal, admission, key) {
+  const proposalValue = stringMetadata(proposal.metadata, key);
+  const admissionValue = stringMetadata(admission.metadata, key);
+  if (proposalValue === void 0 || admissionValue === void 0 || proposalValue === admissionValue)
+    return void 0;
+  return { proposalValue, admissionValue };
+}
+function staleRevision(proposal, admission, workItem) {
+  const authoringRevision = numberMetadata(admission.metadata, "authoringRevision") ?? numberMetadata(proposal.metadata, "authoringRevision");
+  if (authoringRevision !== void 0 && authoringRevision !== workItem.authoringRevision)
+    return {
+      kind: "stale-revision",
+      expected: authoringRevision,
+      current: workItem.authoringRevision
+    };
+  const executionInputRevision = numberMetadata(admission.metadata, "executionInputRevision") ?? numberMetadata(proposal.metadata, "executionInputRevision");
+  if (executionInputRevision !== void 0 && executionInputRevision !== workItem.executionInputRevision)
+    return {
+      kind: "stale-execution-input",
+      expected: executionInputRevision,
+      current: workItem.executionInputRevision
+    };
+  return void 0;
+}
+function applyPolicyMessage(code, proposal, admission) {
+  if (code === "missing-policy")
+    return `Admitted action '${admission.admissionId}' requires an explicit apply policy`;
+  if (code === "unknown-work-item-domain-action-apply-policy")
+    return `Admitted action '${admission.admissionId}' references a missing apply policy`;
+  return `Admitted action '${proposal.proposalId}' matches multiple apply policies`;
+}
+function emitApplication(ctx, state, admission, proposal, applicationState, facts, opts = {}) {
+  const producedFactIds = facts.map((fact) => fact.eventId);
+  const application = {
+    kind: "work-item-domain-action-application",
+    applicationId: `${admission.admissionId}:application`,
+    admissionId: admission.admissionId,
+    proposalId: proposal.proposalId,
+    workItemId: proposal.workItemId,
+    actionKind: proposal.actionKind,
+    state: applicationState,
+    producedFactIds,
+    reason: admission.reason ?? proposal.reason,
+    sourceRefs: admissionRefs(admission, proposal),
+    metadata: { policyId: opts.policyId, code: opts.code }
+  };
+  emitApplicationFact(ctx, "application", application);
+  emitApplicationStatus(ctx, state, {
+    state: applicationState,
+    code: opts.code,
+    message: opts.message,
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    admissionId: admission.admissionId,
+    actionKind: proposal.actionKind,
+    sourceRefs: application.sourceRefs,
+    metadata: { producedFactIds, policyId: opts.policyId }
+  });
+}
+function emitApplicationIssue(ctx, state, key, code, message, workItemId, sourceRefs2, metadata) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  const item = dataIssue2(code, message, { subjectId: workItemId, refs: sourceRefs2, metadata });
+  emitApplicationFact(ctx, "issue", item);
+  emitApplicationStatus(ctx, state, {
+    state: code === "missing-policy" ? "missing-policy" : "rejected",
+    code,
+    message,
+    workItemId,
+    sourceRefs: sourceRefs2,
+    metadata
+  });
+}
+function emitApplicationStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-application-status:${state.statusSeq}`,
+    ...status
+  };
+  emitApplicationFact(ctx, "status", statusFact);
+  emitApplicationAudit(ctx, state, "work-item-domain-action-application-status", statusFact);
+}
+function emitApplicationAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitApplicationFact(ctx, "audit", auditRecord(kind, state.auditSeq, status));
+}
+function emitApplicationFact(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+function firstDuplicateFactId(state, facts) {
+  const pending = /* @__PURE__ */ new Set();
+  for (const fact of facts) {
+    if (state.emittedFactIds.has(fact.eventId) || pending.has(fact.eventId)) return fact.eventId;
+    pending.add(fact.eventId);
+  }
+  return void 0;
+}
+function claimFactId(state, factId) {
+  if (state.emittedFactIds.has(factId)) return false;
+  state.emittedFactIds.add(factId);
+  return true;
+}
+function admissionRefs(admission, proposal, policy) {
+  return uniqueSourceRefs2([
+    ref2("work-item-domain-action-admission", admission.admissionId),
+    ref2("work-item-domain-action-proposal", admission.proposalId),
+    ...proposal === void 0 ? [] : [
+      ref2("work-item", proposal.workItemId),
+      ref2("work-item-evidence", proposal.evidenceId),
+      ...proposal.sourceRefs ?? []
+    ],
+    ...policy === void 0 ? [] : [ref2("work-item-domain-action-apply-policy", policy.policyId)],
+    ...admission.sourceRefs ?? []
+  ]);
+}
+function actionSourceRefs(admission, proposal, policy) {
+  return admissionRefs(admission, proposal, policy);
+}
+
+// src/solutions/work-item/actions-builders.ts
+function workItemDomainActionProposal(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal",
+    proposalId,
+    workItemId,
+    actionKind,
+    effectRunId: opts.effectRunId ?? `domain-action:${proposalId}:effect-run`,
+    effectRunResultId: opts.effectRunResultId ?? `domain-action:${proposalId}:effect-run-result`,
+    evidenceId: opts.evidenceId ?? `domain-action:${proposalId}:evidence`,
+    policyId: opts.policyId ?? "domain-action-proposal",
+    payload: opts.payload,
+    reason: opts.reason,
+    sourceRefs: opts.sourceRefs,
+    proposedAtMs: opts.proposedAtMs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionProposalIntake(proposalId, workItemId, actionKind, opts = {}) {
+  return {
+    kind: "work-item-domain-action-proposal-intake",
+    proposalId,
+    workItemId,
+    actionKind,
+    payload: opts.payload,
+    reason: opts.reason,
+    policyId: opts.policyId,
+    effectRunId: opts.effectRunId,
+    effectRunResultId: opts.effectRunResultId,
+    evidenceId: opts.evidenceId,
+    proposedAtMs: opts.proposedAtMs,
+    sourceRefs: opts.sourceRefs,
+    metadata: opts.metadata
+  };
+}
+function workItemDomainActionApplyPolicy(policyId, opts = {}) {
+  return {
+    kind: "work-item-domain-action-apply-policy",
+    policyId,
+    actionKinds: opts.actionKinds,
+    patch: opts.patch,
+    spawn: opts.spawn,
+    metadata: opts.metadata
+  };
+}
+
+// src/solutions/work-item/actions-capability-guard.ts
+function workItemDomainActionCapabilityGuardProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionCapabilityGuard";
+  const deps = opts.capabilityAdmissionStatus === void 0 ? [opts.proposals, opts.capabilityAdmissions, opts.guardPolicies] : [
+    opts.proposals,
+    opts.capabilityAdmissions,
+    opts.guardPolicies,
+    opts.capabilityAdmissionStatus
+  ];
+  const statusIndex = opts.capabilityAdmissionStatus === void 0 ? -1 : 3;
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    deps,
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Map(),
+        admissionsByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesByCapability: /* @__PURE__ */ new Map(),
+        issueStatusesWithoutCapability: [],
+        policies: /* @__PURE__ */ new Map(),
+        emittedProposalDecisions: /* @__PURE__ */ new Set(),
+        emittedStatusKeys: /* @__PURE__ */ new Set(),
+        issueKeys: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 2) ?? []) {
+        const policyIssue = capabilityGuardPolicyIssue(raw);
+        if (policyIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-policy:${recordString(raw, "policyId") ?? "unknown"}`,
+            policyIssue
+          );
+          continue;
+        }
+        const policy = raw;
+        state.policies.set(policy.policyId, policy);
+      }
+      for (const raw of depBatch(ctx, 1) ?? []) {
+        const admissionIssue = capabilityAdmissionIssue(raw);
+        if (admissionIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-admission:${recordString(raw, "admissionId") ?? "unknown"}`,
+            admissionIssue
+          );
+          continue;
+        }
+        const admission = raw;
+        const capabilityKey = capabilityBoundaryRefId(admission.capability);
+        const byCapability = state.admissionsByCapability.get(capabilityKey) ?? [];
+        if (!byCapability.some((item) => item.admissionId === admission.admissionId)) {
+          state.admissionsByCapability.set(capabilityKey, [...byCapability, admission]);
+        }
+      }
+      if (statusIndex >= 0) {
+        for (const raw of depBatch(ctx, statusIndex) ?? []) {
+          const statusIssue = capabilityAdmissionStatusIssue(raw);
+          if (statusIssue !== void 0) {
+            emitCapabilityGuardIssue(
+              ctx,
+              state,
+              `malformed-capability-status:${recordString(raw, "statusId") ?? "unknown"}`,
+              statusIssue
+            );
+            continue;
+          }
+          const status = raw;
+          if (status.state !== "capability-admission-issue") continue;
+          const capabilityId = status.capabilityId;
+          const capabilityKind = status.capabilityKind;
+          if (capabilityId !== void 0 && capabilityKind !== void 0) {
+            const capabilityKey = capabilityBoundaryRefId({
+              id: capabilityId,
+              kind: capabilityKind
+            });
+            const statuses = state.issueStatusesByCapability.get(capabilityKey) ?? [];
+            if (!statuses.some((item) => item.statusId === status.statusId)) {
+              state.issueStatusesByCapability.set(capabilityKey, [...statuses, status]);
+            }
+          } else if (!state.issueStatusesWithoutCapability.some((item) => item.statusId === status.statusId)) {
+            state.issueStatusesWithoutCapability.push(status);
+          }
+          for (const proposal of state.proposals.values())
+            emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+        }
+      }
+      for (const raw of depBatch(ctx, 0) ?? []) {
+        const proposalIssue = capabilityGuardProposalIssue(raw);
+        if (proposalIssue !== void 0) {
+          emitCapabilityGuardIssue(
+            ctx,
+            state,
+            `malformed-proposal:${recordString(raw, "proposalId") ?? "unknown"}`,
+            proposalIssue
+          );
+          continue;
+        }
+        const proposal = raw;
+        state.proposals.set(proposal.proposalId, proposal);
+      }
+      for (const proposal of state.proposals.values())
+        evaluateCapabilityGuardProposal(ctx, state, proposal, now());
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionCapabilityGuardProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    decisions: project(
+      graph,
+      runtime,
+      `${name}/decisions`,
+      "workItemDomainActionCapabilityGuardDecisions",
+      (fact) => fact.kind === "decision" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionCapabilityGuardStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionCapabilityGuardIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionCapabilityGuardAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function evaluateCapabilityGuardProposal(ctx, state, proposal, decidedAtMs) {
+  if (state.emittedProposalDecisions.has(proposal.proposalId)) return;
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") {
+    emitCapabilityGuardIssue(
+      ctx,
+      state,
+      `policy:${proposal.proposalId}:${policy}`,
+      dataIssue2(policy, capabilityGuardPolicyMessage(policy, proposal), {
+        subjectId: proposal.workItemId,
+        refs: [ref2("work-item-domain-action-proposal", proposal.proposalId)]
+      })
+    );
+    return;
+  }
+  for (const status of state.issueStatusesWithoutCapability)
+    emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  for (const capabilityRef of policy.capabilityRefs) {
+    for (const status of state.issueStatusesByCapability.get(
+      capabilityBoundaryRefId(capabilityRef)
+    ) ?? [])
+      emitCapabilityStatusIssueForProposal(ctx, state, proposal, status);
+  }
+  const admissions = policy.capabilityRefs.map(
+    (capabilityRef) => latestCapabilityAdmission(state, policy, capabilityRef)
+  );
+  const missingCapabilityRefs = policy.capabilityRefs.filter(
+    (_, index) => admissions[index] === void 0
+  );
+  const deferredCapabilityRefs = admissions.filter((admission) => admission !== void 0).filter((admission) => admission.state === "deferred").map((admission) => capabilityBoundaryRefId(admission.capability));
+  if (missingCapabilityRefs.length > 0 || deferredCapabilityRefs.length > 0) {
+    emitCapabilityGuardStatusOnce(
+      ctx,
+      state,
+      `deferred:${proposal.proposalId}:${policy.policyId}:missing=${missingCapabilityRefs.map(capabilityBoundaryRefId).join(",")}:deferred=${deferredCapabilityRefs.join(",")}`,
+      {
+        state: "deferred",
+        workItemId: proposal.workItemId,
+        proposalId: proposal.proposalId,
+        actionKind: proposal.actionKind,
+        policyId: policy.policyId,
+        capabilityRefs: policy.capabilityRefs,
+        admissionSubjectIds: policy.admissionSubjectIds,
+        message: "WorkItem domain action is waiting for capability admission",
+        sourceRefs: capabilityGuardRefs(proposal, policy, admissions),
+        metadata: {
+          missingCapabilityRefs: missingCapabilityRefs.map(capabilityBoundaryRefId),
+          deferredCapabilityRefs
+        }
+      }
+    );
+    return;
+  }
+  const presentAdmissions = admissions.filter(
+    (admission) => admission !== void 0
+  );
+  const blocked = presentAdmissions.filter((admission) => admission.state === "blocked");
+  const outcome = blocked.length === 0 ? "admit" : "reject";
+  const decision = {
+    kind: "work-item-domain-action-admission-decision",
+    decisionId: `capability-guard:${proposal.proposalId}:decision`,
+    admissionId: `capability-guard:${proposal.proposalId}:admission`,
+    proposalId: proposal.proposalId,
+    outcome,
+    reason: blocked.length === 0 ? "Capability guard admitted required capabilities" : "Capability guard rejected blocked capabilities",
+    decidedAtMs,
+    sourceRefs: capabilityGuardRefs(proposal, policy, presentAdmissions),
+    metadata: {
+      capabilityGuardPolicyId: policy.policyId,
+      capabilityRefs: policy.capabilityRefs.map(capabilityBoundaryRefId),
+      admissionSubjectIds: policy.admissionSubjectIds,
+      blockedCapabilityRefs: blocked.map(
+        (admission) => capabilityBoundaryRefId(admission.capability)
+      )
+    }
+  };
+  state.emittedProposalDecisions.add(proposal.proposalId);
+  emitCapabilityGuard(ctx, "decision", decision);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: outcome === "admit" ? "admitted" : "rejected",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    policyId: policy.policyId,
+    capabilityRefs: policy.capabilityRefs,
+    admissionSubjectIds: policy.admissionSubjectIds,
+    admissionIds: presentAdmissions.map((admission) => admission.admissionId),
+    sourceRefs: decision.sourceRefs,
+    metadata: { decisionId: decision.decisionId, admissionId: decision.admissionId }
+  });
+}
+function capabilityGuardProposalIssue(proposal) {
+  if (!isRecord(proposal) || proposal.kind !== "work-item-domain-action-proposal" || typeof proposal.proposalId !== "string" || proposal.proposalId.length === 0 || typeof proposal.workItemId !== "string" || proposal.workItemId.length === 0 || typeof proposal.actionKind !== "string" || proposal.actionKind.length === 0 || proposal.sourceRefs !== void 0 && !isSourceRefArray(proposal.sourceRefs)) {
+    return dataIssue2(
+      "malformed-work-item-domain-action-capability-guard-proposal",
+      "WorkItem domain action capability guard requires valid proposal DATA facts",
+      { subjectId: recordString(proposal, "workItemId") }
+    );
+  }
+  return void 0;
+}
+function capabilityGuardPolicyIssue(policy) {
+  if (!isRecord(policy) || policy.kind !== "work-item-domain-action-capability-guard-policy" || typeof policy.policyId !== "string" || policy.policyId.length === 0 || !Array.isArray(policy.capabilityRefs) || policy.capabilityRefs.length === 0 || !policy.capabilityRefs.every(isBoundaryCapabilityRef) || !Array.isArray(policy.admissionSubjectIds) || policy.admissionSubjectIds.length === 0 || !policy.admissionSubjectIds.every((id) => typeof id === "string" && id.length > 0) || policy.actionKinds !== void 0 && (!Array.isArray(policy.actionKinds) || !policy.actionKinds.every((kind) => typeof kind === "string" && kind.length > 0))) {
+    return dataIssue2(
+      "malformed-work-item-domain-action-capability-guard-policy",
+      "WorkItem domain action capability guard policy requires policyId, capabilityRefs, and admissionSubjectIds",
+      {
+        subjectId: recordString(policy, "policyId")
+      }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionIssue(admission) {
+  if (!isRecord(admission) || admission.kind !== "capability-admission" || typeof admission.admissionId !== "string" || admission.admissionId.length === 0 || typeof admission.proposalId !== "string" || admission.proposalId.length === 0 || typeof admission.subjectId !== "string" || admission.subjectId.length === 0 || !isBoundaryCapabilityRef(admission.capability) || !isCapabilityAdmissionState(admission.state) || typeof admission.decisionId !== "string" || admission.decisionId.length === 0 || admission.sourceRefs !== void 0 && !isSourceRefArray(admission.sourceRefs)) {
+    return dataIssue2(
+      "malformed-capability-admission",
+      "WorkItem domain action capability guard requires valid CapabilityAdmission DATA facts",
+      { subjectId: recordString(admission, "subjectId") }
+    );
+  }
+  return void 0;
+}
+function capabilityAdmissionStatusIssue(status) {
+  if (!isRecord(status) || status.kind !== "capability-admission-status" || typeof status.statusId !== "string" || status.statusId.length === 0 || !isCapabilityAdmissionStatusState(status.state)) {
+    return dataIssue2(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
+  }
+  const hasCapabilityId = status.capabilityId !== void 0;
+  const hasCapabilityKind = status.capabilityKind !== void 0;
+  if (hasCapabilityId !== hasCapabilityKind || hasCapabilityId && (typeof status.capabilityId !== "string" || status.capabilityId.length === 0 || !isBoundaryCapabilityKind(status.capabilityKind)) || status.sourceRefs !== void 0 && !isSourceRefArray(status.sourceRefs) || status.issues !== void 0 && !isDataIssueArray(status.issues)) {
+    return dataIssue2(
+      "malformed-capability-admission-status",
+      "WorkItem domain action capability guard requires valid CapabilityAdmissionStatus DATA facts",
+      { subjectId: recordString(status, "subjectId") }
+    );
+  }
+  return void 0;
+}
+function isCapabilityAdmissionState(value) {
+  return value === "allowed" || value === "blocked" || value === "deferred";
+}
+function isCapabilityAdmissionStatusState(value) {
+  return value === "capability-admission-allowed" || value === "capability-admission-blocked" || value === "capability-admission-deferred" || value === "capability-admission-issue";
+}
+function isSourceRefArray(value) {
+  return Array.isArray(value) && value.every(
+    (item) => isRecord(item) && typeof item.kind === "string" && typeof item.id === "string"
+  );
+}
+function isDataIssueArray(value) {
+  return Array.isArray(value) && value.every(isDataIssue);
+}
+function isDataIssue(value) {
+  return isRecord(value) && value.kind === "issue" && typeof value.code === "string" && value.code.length > 0 && typeof value.message === "string" && value.message.length > 0;
+}
+function isBoundaryCapabilityRef(value) {
+  return isRecord(value) && typeof value.id === "string" && value.id.length > 0 && isBoundaryCapabilityKind(value.kind) && typeof value.required === "boolean" && (value.sourceRefs === void 0 || Array.isArray(value.sourceRefs) && value.sourceRefs.every((sourceRef) => typeof sourceRef === "string"));
+}
+function isBoundaryCapabilityKind(value) {
+  return value === "auth" || value === "permission" || value === "config" || value === "resource";
+}
+function selectCapabilityGuardPolicy(state, proposal) {
+  const explicitId = stringMetadata(proposal.metadata, "capabilityGuardPolicyId") ?? proposal.sourceRefs?.find(
+    (sourceRef) => sourceRef.kind === "work-item-domain-action-capability-guard-policy"
+  )?.id;
+  if (explicitId !== void 0)
+    return state.policies.get(explicitId) ?? "unknown-work-item-domain-action-capability-guard-policy";
+  const matching = [...state.policies.values()].filter(
+    (policy) => policy.actionKinds === void 0 || policy.actionKinds.includes(proposal.actionKind)
+  );
+  if (matching.length === 0) return "missing-policy";
+  if (matching.length > 1) return "policy-mismatch";
+  return matching[0];
+}
+function latestCapabilityAdmission(state, policy, capabilityRef) {
+  const admissions = state.admissionsByCapability.get(capabilityBoundaryRefId(capabilityRef)) ?? [];
+  for (let index = admissions.length - 1; index >= 0; index -= 1) {
+    const admission = admissions[index];
+    if (admission !== void 0 && policy.admissionSubjectIds.includes(admission.subjectId))
+      return admission;
+  }
+  return void 0;
+}
+function emitCapabilityStatusIssueForProposal(ctx, state, proposal, status) {
+  const policy = selectCapabilityGuardPolicy(state, proposal);
+  if (typeof policy === "string") return;
+  if (status.subjectId !== void 0 && !policy.admissionSubjectIds.includes(status.subjectId))
+    return;
+  const capabilityId = status.capabilityId;
+  const capabilityKind = status.capabilityKind;
+  const statusCapabilityKey = capabilityId === void 0 || capabilityKind === void 0 ? void 0 : capabilityBoundaryRefId({ id: capabilityId, kind: capabilityKind });
+  if (statusCapabilityKey !== void 0 && !policy.capabilityRefs.some(
+    (capabilityRef) => capabilityBoundaryRefId(capabilityRef) === statusCapabilityKey
+  ))
+    return;
+  const issue2 = status.issues?.[0] ?? dataIssue2(
+    "capability-admission-status-issue",
+    "Capability admission status reported an issue",
+    { subjectId: proposal.workItemId }
+  );
+  emitCapabilityGuardIssue(
+    ctx,
+    state,
+    `capability-status:${proposal.proposalId}:${status.statusId}`,
+    dataIssue2(issue2.code, issue2.message, {
+      subjectId: proposal.workItemId,
+      refs: uniqueSourceRefs2([
+        ...capabilityGuardRefs(proposal, policy),
+        ...status.sourceRefs ?? []
+      ]),
+      metadata: {
+        ...statusCapabilityKey === void 0 ? {} : { capabilityRef: statusCapabilityKey },
+        capabilityAdmissionStatusId: status.statusId
+      }
+    })
+  );
+}
+function capabilityGuardPolicyMessage(code, proposal) {
+  if (code === "missing-policy")
+    return `WorkItem domain action '${proposal.proposalId}' has no capability guard policy`;
+  if (code === "unknown-work-item-domain-action-capability-guard-policy")
+    return `WorkItem domain action '${proposal.proposalId}' references a missing capability guard policy`;
+  return `WorkItem domain action '${proposal.proposalId}' matches multiple capability guard policies`;
+}
+function capabilityGuardRefs(proposal, policy, admissions = []) {
+  return uniqueSourceRefs2([
+    ref2("work-item", proposal.workItemId),
+    ref2("work-item-domain-action-proposal", proposal.proposalId),
+    ref2("work-item-domain-action-capability-guard-policy", policy.policyId),
+    ...admissions.filter((admission) => admission !== void 0).flatMap((admission) => [
+      ref2("capability-admission", admission.admissionId),
+      ref2("capability-admission-proposal", admission.proposalId),
+      ref2("boundary-capability", capabilityBoundaryRefId(admission.capability)),
+      ...admission.sourceRefs ?? []
+    ]),
+    ...proposal.sourceRefs ?? []
+  ]);
+}
+function capabilityBoundaryRefId(capability) {
+  return `${capability.kind}:${capability.id}`;
+}
+function emitCapabilityGuardStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-capability-guard-status",
+    statusId: `work-item-domain-action-capability-guard-status:${state.statusSeq}`,
+    ...status
+  };
+  emitCapabilityGuard(ctx, "status", statusFact);
+  state.auditSeq += 1;
+  emitCapabilityGuard(ctx, "audit", {
+    id: `work-item-domain-action-capability-guard-status:${state.auditSeq}`,
+    kind: "work-item-domain-action-capability-guard-status",
+    subjectId: status.workItemId,
+    message: status.message,
+    sourceRefs: status.sourceRefs,
+    metadata: {
+      statusId: statusFact.statusId,
+      state: status.state,
+      proposalId: status.proposalId,
+      policyId: status.policyId,
+      ...status.metadata ?? {}
+    }
+  });
+}
+function emitCapabilityGuardStatusOnce(ctx, state, key, status) {
+  if (state.emittedStatusKeys.has(key)) return;
+  state.emittedStatusKeys.add(key);
+  emitCapabilityGuardStatus(ctx, state, status);
+}
+function emitCapabilityGuardIssue(ctx, state, key, issue2) {
+  if (state.issueKeys.has(key)) return;
+  state.issueKeys.add(key);
+  emitCapabilityGuard(ctx, "issue", issue2);
+  emitCapabilityGuardStatus(ctx, state, {
+    state: "issue",
+    workItemId: issue2.subjectId,
+    issues: [issue2],
+    message: issue2.message,
+    metadata: { issueCode: issue2.code }
+  });
+}
+function emitCapabilityGuard(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+
+// src/solutions/work-item/actions-intake.ts
+function workItemDomainActionProposalIntakeProjector(graph, opts) {
+  const name = opts.name ?? "workItemDomainActionIntake";
+  const now = opts.now ?? Date.now;
+  const runtime = graph.node(
+    [opts.proposals],
+    (ctx) => {
+      const state = ctx.state.get() ?? {
+        proposals: /* @__PURE__ */ new Set(),
+        statusSeq: 0,
+        auditSeq: 0
+      };
+      for (const raw of depBatch(ctx, 0) ?? []) reduceProposalIntake(ctx, state, raw, now());
+      ctx.state.set(state);
+    },
+    {
+      name: `${name}/runtime`,
+      factory: "workItemDomainActionProposalIntakeProjector",
+      partial: true,
+      completeWhenDepsComplete: false,
+      errorWhenDepsError: false
+    }
+  );
+  return {
+    proposals: project(
+      graph,
+      runtime,
+      `${name}/proposals`,
+      "workItemDomainActionProposals",
+      (fact) => fact.kind === "proposal" ? fact.value : void 0
+    ),
+    status: project(
+      graph,
+      runtime,
+      `${name}/status`,
+      "workItemDomainActionStatus",
+      (fact) => fact.kind === "status" ? fact.value : void 0
+    ),
+    issues: project(
+      graph,
+      runtime,
+      `${name}/issues`,
+      "workItemDomainActionIssues",
+      (fact) => fact.kind === "issue" ? fact.value : void 0
+    ),
+    audit: project(
+      graph,
+      runtime,
+      `${name}/audit`,
+      "workItemDomainActionAudit",
+      (fact) => fact.kind === "audit" ? fact.value : void 0
+    )
+  };
+}
+function reduceProposalIntake(ctx, state, input, proposedAtMs) {
+  const proposal = normalizeProposal(input, proposedAtMs);
+  if (typeof proposal === "string") {
+    const issue2 = dataIssue2("malformed-domain-action-proposal", proposal);
+    emitIntake(ctx, "issue", issue2);
+    emitIntakeStatus(ctx, state, {
+      state: "rejected",
+      code: issue2.code,
+      message: issue2.message
+    });
+    return;
+  }
+  if (state.proposals.has(proposal.proposalId)) {
+    emitIntakeStatus(ctx, state, {
+      state: "duplicate",
+      code: "duplicate-suppressed",
+      workItemId: proposal.workItemId,
+      proposalId: proposal.proposalId,
+      actionKind: proposal.actionKind,
+      message: `Duplicate WorkItem domain action proposal '${proposal.proposalId}' suppressed`
+    });
+    return;
+  }
+  state.proposals.add(proposal.proposalId);
+  emitIntake(ctx, "proposal", proposal);
+  emitIntakeStatus(ctx, state, {
+    state: "proposed",
+    workItemId: proposal.workItemId,
+    proposalId: proposal.proposalId,
+    actionKind: proposal.actionKind,
+    sourceRefs: proposal.sourceRefs
+  });
+}
+function normalizeProposal(input, proposedAtMs) {
+  if (!isRecord(input)) return "WorkItemDomainActionProposal intake must be an object";
+  if (input.kind !== "work-item-domain-action-proposal" && input.kind !== "work-item-domain-action-proposal-intake")
+    return "WorkItemDomainActionProposal intake has unsupported kind";
+  if (typeof input.proposalId !== "string" || input.proposalId.trim() === "")
+    return "WorkItemDomainActionProposal.proposalId is required";
+  if (typeof input.workItemId !== "string" || input.workItemId.trim() === "")
+    return "WorkItemDomainActionProposal.workItemId is required";
+  if (typeof input.actionKind !== "string" || input.actionKind.trim() === "")
+    return "WorkItemDomainActionProposal.actionKind is required";
+  if (input.kind === "work-item-domain-action-proposal") {
+    if (typeof input.effectRunId !== "string")
+      return "WorkItemDomainActionProposal.effectRunId is required";
+    if (typeof input.effectRunResultId !== "string")
+      return "WorkItemDomainActionProposal.effectRunResultId is required";
+    if (typeof input.evidenceId !== "string")
+      return "WorkItemDomainActionProposal.evidenceId is required";
+    if (typeof input.policyId !== "string")
+      return "WorkItemDomainActionProposal.policyId is required";
+    return input;
+  }
+  return workItemDomainActionProposal(
+    input.proposalId,
+    input.workItemId,
+    input.actionKind,
+    {
+      payload: input.payload,
+      reason: typeof input.reason === "string" ? input.reason : void 0,
+      policyId: typeof input.policyId === "string" ? input.policyId : void 0,
+      effectRunId: typeof input.effectRunId === "string" ? input.effectRunId : void 0,
+      effectRunResultId: typeof input.effectRunResultId === "string" ? input.effectRunResultId : void 0,
+      evidenceId: typeof input.evidenceId === "string" ? input.evidenceId : void 0,
+      proposedAtMs: typeof input.proposedAtMs === "number" ? input.proposedAtMs : proposedAtMs,
+      sourceRefs: sourceRefs(input.sourceRefs),
+      metadata: isRecord(input.metadata) ? input.metadata : void 0
+    }
+  );
+}
+function emitIntakeStatus(ctx, state, status) {
+  state.statusSeq += 1;
+  const statusFact = {
+    kind: "work-item-domain-action-status",
+    statusId: `work-item-domain-action-intake-status:${state.statusSeq}`,
+    ...status
+  };
+  emitIntake(ctx, "status", statusFact);
+  emitIntakeAudit(ctx, state, "work-item-domain-action-intake-status", statusFact);
+}
+function emitIntakeAudit(ctx, state, kind, status) {
+  state.auditSeq += 1;
+  emitIntake(ctx, "audit", auditRecord(kind, state.auditSeq, status));
+}
+function emitIntake(ctx, kind, value) {
+  ctx.down([["DATA", { kind, value }]]);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  workItemDomainActionAdmissionProjector,
+  workItemDomainActionApplicationProjector,
+  workItemDomainActionApplyPolicy,
+  workItemDomainActionCapabilityGuardProjector,
+  workItemDomainActionProposal,
+  workItemDomainActionProposalIntake,
+  workItemDomainActionProposalIntakeProjector
+});
+//# sourceMappingURL=actions.cjs.map