@knpkv/control-center 0.1.0

package/dist/server/assets/readiness-CzU3vjYQ.js

@@ -0,0 +1,1012 @@
+import { Ar as GovernedActionAuthorizationId, Bt as HumanActor, Cn as ReadinessReleaseRevision, Cr as EntityId, Dr as EvidenceId, En as ReadinessRuleVersion, Er as EvidenceClaimId, Fn as compareReadinessText, Fr as PersonId, Gn as deriveReleaseReadinessVerdict, Gr as ShareId, Hn as deriveReleaseReadinessNextEvaluationAt, Hr as ReleaseId, Ir as PluginConnectionId, Kn as readinessDefinitionsShapeIsV1, Kr as WorkspaceId, Mr as GovernedActionTransitionId, Pr as JobId, Rr as ReadinessAssessmentId, Rt as AgentActor, Sr as DomainEventId, Un as deriveReleaseReadinessSourceSummaries, Vn as deriveReleaseReadinessFindings, Wn as deriveReleaseReadinessStages, Wr as SessionId, Wt as Role, _r as SourceUrl, ar as MaximumPluginPayloadBytes, bt as SemanticVersion, cr as hasMaximumPluginJsonBytes, dn as ReadinessFactDefinition, gr as SourceRevision, hn as ReadinessFactObservation, hr as Revision, in as ReadinessArtifactRevision, jr as GovernedActionId, kr as GovernedActionAttemptId, mr as ProviderId, on as ReadinessCandidateDigest, or as MaximumPluginSyncPageBytes, rr as sortedReadinessUnique, sr as PluginPayloadJson, t as DomainEventCorrelationId, tr as readinessPolicyShapeIsV1, vr as VendorImmutableId, wn as ReadinessRuleId, wr as EnvironmentId, yr as UtcTimestamp, yt as PluginId } from "./domainEvent-x7yeq-gU.js";
+import * as Schema from "effect/Schema";
+import * as DateTime from "effect/DateTime";
+import * as Effect from "effect/Effect";
+import * as Result from "effect/Result";
+import * as SchemaGetter from "effect/SchemaGetter";
+import * as Encoding from "effect/Encoding";
+//#region src/domain/authorizedShare.ts
+/** Exact normalized entity scope granted to one authenticated person. */
+var AuthorizedShareTarget = Schema.TaggedStruct("entity", { entityId: EntityId });
+/** Durable authenticated grant with immutable creation and optional revocation evidence. */
+var AuthorizedShareGrant = Schema.Struct({
+	workspaceId: WorkspaceId,
+	shareId: ShareId,
+	target: AuthorizedShareTarget,
+	granteePersonId: PersonId,
+	createdByPersonId: PersonId,
+	createdBySessionId: SessionId,
+	createdAt: UtcTimestamp,
+	expiresAt: UtcTimestamp,
+	revokedAt: Schema.NullOr(UtcTimestamp)
+}).check(Schema.makeFilter(({ createdAt, expiresAt }) => DateTime.Order(createdAt, expiresAt) < 0, { expected: "authorized share expiry after creation" }), Schema.makeFilter(({ createdAt, revokedAt }) => revokedAt === null || DateTime.Order(createdAt, revokedAt) <= 0, { expected: "authorized share revocation at or after creation" }));
+//#endregion
+//#region src/domain/plugins/events.ts
+var boundedOpaque$1 = (name, maximum) => Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(maximum)).pipe(Schema.brand(name));
+/** Stable adapter event identity used to make checkpoint replay idempotent. */
+var PluginEventId = boundedOpaque$1("PluginEventId", 512);
+/** Opaque bounded checkpoint owned by one plugin sync stream. */
+var PluginCheckpointV1 = boundedOpaque$1("PluginCheckpointV1", 2048);
+/** Opaque page cursor for optional paginated reads. */
+var PluginPageCursorV1 = boundedOpaque$1("PluginPageCursorV1", 2048);
+/** Stable entity category emitted without vendor-specific response shapes. */
+var PluginEntityType = boundedOpaque$1("PluginEntityType", 100);
+var SafeSummary$1 = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(500));
+var MaximumDiffContentBytes = 1048576;
+var MaximumDiffContentBase64Characters = 4 * Math.ceil(MaximumDiffContentBytes / 3);
+var hasSafeRelativePathShape = Schema.makeFilter((value) => {
+	if (value.startsWith("/") || value.includes("\\") || /^[a-zA-Z]:/u.test(value)) return false;
+	return value.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..") && Array.from(value).every((character) => {
+		const codePoint = character.codePointAt(0);
+		return codePoint !== void 0 && !(codePoint >= 0 && codePoint <= 31 || codePoint >= 127 && codePoint <= 159);
+	});
+}, { expected: "a normalized provider-relative path without traversal or control characters" });
+var hasMaximumDecodedDiffBytes = Schema.makeFilter((value) => {
+	const decoded = Encoding.decodeBase64(value);
+	return Result.isSuccess(decoded) && decoded.success.byteLength <= MaximumDiffContentBytes;
+}, { expected: `base64 data decoding to at most ${MaximumDiffContentBytes} bytes` });
+/** Normalized provider-relative path safe to carry across diff and storage boundaries. */
+var PluginRelativePathV1 = Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(4096), hasSafeRelativePathShape).pipe(Schema.brand("PluginRelativePathV1"));
+var PluginDiffContentBase64V1 = Schema.String.check(Schema.isMaxLength(MaximumDiffContentBase64Characters), Schema.isBase64(), hasMaximumDecodedDiffBytes);
+var commonEventFields = {
+	eventId: PluginEventId,
+	observedAt: UtcTimestamp,
+	revision: Revision
+};
+var entityReferenceFields = {
+	entityType: PluginEntityType,
+	vendorImmutableId: VendorImmutableId
+};
+/** Adapter-owned reference to a provider entity; host scope is deliberately absent. */
+var PluginEntityReferenceV1 = Schema.Struct(entityReferenceFields);
+var UpsertEntity = Schema.TaggedStruct("UpsertEntity", {
+	...commonEventFields,
+	...entityReferenceFields,
+	sourceUrl: Schema.NullOr(SourceUrl),
+	title: SafeSummary$1,
+	attributes: Schema.Record(Schema.String.check(Schema.isNonEmpty(), Schema.isMaxLength(200)), Schema.Json).check(hasMaximumPluginJsonBytes(MaximumPluginPayloadBytes))
+});
+var TombstoneEntity = Schema.TaggedStruct("TombstoneEntity", {
+	...commonEventFields,
+	...entityReferenceFields,
+	reason: SafeSummary$1
+});
+var AppendEvidence = Schema.TaggedStruct("AppendEvidence", {
+	...commonEventFields,
+	evidenceId: boundedOpaque$1("PluginEvidenceId", 512),
+	subject: PluginEntityReferenceV1,
+	evidenceType: boundedOpaque$1("PluginEvidenceType", 100),
+	summary: SafeSummary$1,
+	capturedAt: UtcTimestamp,
+	data: PluginPayloadJson
+});
+var UpsertPerson = Schema.TaggedStruct("UpsertPerson", {
+	...commonEventFields,
+	vendorPersonId: boundedOpaque$1("PluginVendorPersonId", 512),
+	displayName: Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200)),
+	avatarUrl: Schema.NullOr(SourceUrl),
+	active: Schema.Boolean
+});
+var ProposeRelationship = Schema.TaggedStruct("ProposeRelationship", {
+	...commonEventFields,
+	relationshipId: boundedOpaque$1("PluginRelationshipId", 512),
+	from: PluginEntityReferenceV1,
+	to: PluginEntityReferenceV1,
+	relationshipType: boundedOpaque$1("PluginRelationshipType", 100),
+	confidence: Schema.Number.check(Schema.isBetween({
+		minimum: 0,
+		maximum: 1
+	})),
+	evidenceIds: Schema.Array(boundedOpaque$1("PluginRelationshipEvidenceId", 512)).check(Schema.makeFilter((evidenceIds) => evidenceIds.length <= 100, { expected: "at most 100 relationship evidence identities" }), Schema.isUnique())
+});
+/** Vendor-neutral event emitted by a plugin and scoped by the host on ingestion. */
+var NormalizedPluginEventV1 = Schema.Union([
+	UpsertEntity,
+	TombstoneEntity,
+	AppendEvidence,
+	UpsertPerson,
+	ProposeRelationship
+]).pipe(Schema.toTaggedUnion("_tag"));
+/** A fully decoded page whose events and checkpoint must commit atomically. */
+var PluginSyncPageV1 = Schema.Struct({
+	events: Schema.Array(NormalizedPluginEventV1).check(Schema.makeFilter((events) => events.length <= 500, { expected: "at most 500 normalized plugin events" }), Schema.makeFilter((events) => new Set(events.map(({ eventId }) => eventId)).size === events.length, { expected: "unique normalized plugin event identities within a page" })),
+	checkpointAfterPage: PluginCheckpointV1,
+	hasMore: Schema.Boolean
+}).check(hasMaximumPluginJsonBytes(MaximumPluginSyncPageBytes)).annotate({ identifier: "PluginSyncPageV1" });
+/** Request to resume a logical plugin stream from an accepted checkpoint. */
+var PluginSyncRequestV1 = Schema.Struct({
+	streamKey: boundedOpaque$1("PluginSyncStreamKey", 100),
+	checkpoint: Schema.NullOr(PluginCheckpointV1)
+}).annotate({ identifier: "PluginSyncRequestV1" });
+/** Request for one normalized entity by its immutable provider reference. */
+var ReadPluginEntityRequestV1 = PluginEntityReferenceV1;
+var FoundPluginEntity = Schema.TaggedStruct("found", { event: UpsertEntity });
+var MissingPluginEntity = Schema.TaggedStruct("missing", {
+	reference: PluginEntityReferenceV1,
+	observedAt: UtcTimestamp
+});
+/** Authoritative result of a normalized plugin entity read. */
+var ReadPluginEntityResultV1 = Schema.Union([FoundPluginEntity, MissingPluginEntity]).pipe(Schema.toTaggedUnion("_tag"));
+/** One bounded file-like entry in a complete diff inventory. */
+var PluginDiffInventoryEntryV1 = Schema.Struct({
+	path: PluginRelativePathV1,
+	previousPath: Schema.NullOr(PluginRelativePathV1),
+	status: Schema.Literals([
+		"added",
+		"modified",
+		"deleted",
+		"renamed",
+		"copied"
+	]),
+	binary: Schema.Boolean,
+	generated: Schema.Boolean,
+	oversized: Schema.Boolean
+});
+/** Request for one page of a complete diff inventory. */
+var DiffInventoryPageRequestV1 = Schema.Struct({
+	entity: PluginEntityReferenceV1,
+	cursor: Schema.NullOr(PluginPageCursorV1)
+});
+/** A bounded diff inventory page. */
+var DiffInventoryPageV1 = Schema.Struct({
+	entries: Schema.Array(PluginDiffInventoryEntryV1).check(Schema.makeFilter((entries) => entries.length <= 500, { expected: "at most 500 diff inventory entries" })),
+	nextCursor: Schema.NullOr(PluginPageCursorV1)
+});
+/** Request for a bounded byte range of before/after diff content. */
+var DiffContentRangeRequestV1 = Schema.Struct({
+	entity: PluginEntityReferenceV1,
+	path: PluginRelativePathV1,
+	side: Schema.Literals(["before", "after"]),
+	offset: Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)),
+	length: Schema.Int.check(Schema.isBetween({
+		minimum: 1,
+		maximum: 1048576
+	}))
+});
+/** Bounded content range with explicit availability metadata. */
+var DiffContentRangeV1 = Schema.Struct({
+	bytesBase64: Schema.NullOr(PluginDiffContentBase64V1),
+	totalBytes: Schema.NullOr(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0))),
+	unavailableReason: Schema.NullOr(Schema.Literals([
+		"binary",
+		"generated",
+		"oversized",
+		"missing",
+		"provider-unavailable"
+	]))
+}).check(Schema.makeFilter(({ bytesBase64, totalBytes, unavailableReason }) => unavailableReason === null ? bytesBase64 !== null && totalBytes !== null : bytesBase64 === null, { expected: "available content bytes or an explicit unavailable reason" }));
+//#endregion
+//#region src/domain/plugins/actions.ts
+var boundedOpaque = (name, maximum) => Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(maximum)).pipe(Schema.brand(name));
+var PositiveInteger$2 = Schema.Int.check(Schema.isGreaterThan(0));
+var SafeSummary = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(1e3));
+/** Lowercase SHA-256 digest of a canonical governed-action payload. */
+var PluginActionPayloadDigest = Schema.String.check(Schema.isPattern(/^[0-9a-f]{64}$/u, { expected: "a lowercase SHA-256 digest" })).pipe(Schema.brand("PluginActionPayloadDigest"));
+/** Opaque provider locator used to reconcile a mutation without replaying it. */
+var PluginActionReconciliationKey = boundedOpaque("PluginActionReconciliationKey", 512);
+/** Opaque provider identity of one accepted or completed mutation. */
+var PluginProviderOperationId = boundedOpaque("PluginProviderOperationId", 512);
+/** Request for a provider-neutral action proposal; it cannot authorize execution. */
+var ProposePluginActionRequestV1 = Schema.Struct({
+	actionKind: boundedOpaque("PluginActionKind", 100),
+	target: PluginEntityReferenceV1,
+	expectedRevision: Revision,
+	payload: PluginPayloadJson,
+	evidenceIds: Schema.Array(boundedOpaque("PluginActionEvidenceId", 512)).check(Schema.isUnique(), Schema.makeFilter((evidenceIds) => evidenceIds.length <= 100, { expected: "at most 100 action evidence identities" }))
+});
+/** Proposal returned to the host for later policy and human authorization. */
+var PluginActionProposalV1 = Schema.Struct({
+	proposalKey: boundedOpaque("PluginActionProposalKey", 512),
+	capabilityVersion: PositiveInteger$2,
+	request: ProposePluginActionRequestV1,
+	payloadDigest: PluginActionPayloadDigest,
+	summary: SafeSummary,
+	impact: Schema.Struct({
+		level: Schema.Literals([
+			"low",
+			"medium",
+			"high",
+			"critical"
+		]),
+		summary: SafeSummary
+	}),
+	proposedAt: UtcTimestamp
+});
+/** Host-authorized request accepted only by the sealed internal executor. */
+var AuthorizedPluginActionV1 = Schema.Struct({
+	proposal: PluginActionProposalV1,
+	idempotencyKey: boundedOpaque("PluginActionIdempotencyKey", 512),
+	payloadDigest: PluginActionPayloadDigest,
+	authorizationId: boundedOpaque("PluginActionAuthorizationId", 512),
+	authorizedAt: UtcTimestamp,
+	expiresAt: UtcTimestamp
+}).check(Schema.makeFilter(({ authorizedAt, expiresAt }) => DateTime.Order(authorizedAt, expiresAt) < 0, { expected: "plugin action authorization to expire after it is issued" }), Schema.makeFilter(({ payloadDigest, proposal }) => payloadDigest === proposal.payloadDigest, { expected: "authorized payload digest to match its canonical proposal digest" }));
+var providerReceiptFields = {
+	providerOperationId: PluginProviderOperationId,
+	safeSummary: SafeSummary,
+	observedAt: UtcTimestamp
+};
+/** Accepted provider work that remains unresolved and can be reconciled safely. */
+var PluginAcceptedProviderReceiptV1 = Schema.Struct({
+	...providerReceiptFields,
+	status: Schema.Literal("accepted"),
+	reconciliationKey: PluginActionReconciliationKey
+});
+/** Terminal provider receipt safe to persist and display without raw response data. */
+var PluginTerminalProviderReceiptV1 = Schema.Struct({
+	...providerReceiptFields,
+	status: Schema.Literals([
+		"succeeded",
+		"failed",
+		"cancelled"
+	])
+});
+/** Provider receipt that never represents accepted asynchronous work as terminal. */
+var PluginProviderReceiptV1 = Schema.Union([PluginAcceptedProviderReceiptV1, PluginTerminalProviderReceiptV1]);
+/** Provider preflight that confirms the exact revision is ready for dispatch. */
+var ReadyPluginActionPreflightV1 = Schema.TaggedStruct("ready", {
+	checkedRevision: Revision,
+	checkedAt: UtcTimestamp
+});
+/** Provider preflight that blocks dispatch with bounded safe reasons. */
+var BlockedPluginActionPreflightV1 = Schema.TaggedStruct("blocked", {
+	reasons: Schema.Array(SafeSummary).check(Schema.isNonEmpty(), Schema.makeFilter((reasons) => reasons.length <= 50, { expected: "at most 50 preflight reasons" })),
+	checkedAt: UtcTimestamp
+});
+/** Result of the final provider preflight before dispatch. */
+var PluginActionPreflightV1 = Schema.Union([ReadyPluginActionPreflightV1, BlockedPluginActionPreflightV1]).pipe(Schema.toTaggedUnion("_tag"));
+var ConfirmedDispatch = Schema.TaggedStruct("confirmed", { receipt: PluginProviderReceiptV1 });
+var UnknownDispatch = Schema.TaggedStruct("unknown", {
+	reconciliationKey: PluginActionReconciliationKey,
+	safeSummary: SafeSummary,
+	observedAt: UtcTimestamp
+});
+/** Truthful immediate outcome of one authorized provider dispatch. */
+var PluginActionDispatchResultV1 = Schema.Union([ConfirmedDispatch, UnknownDispatch]).pipe(Schema.toTaggedUnion("_tag"));
+/** Request to cancel an action after its durable lifecycle permits cancellation. */
+var PluginActionCancellationRequestV1 = Schema.Struct({
+	idempotencyKey: boundedOpaque("PluginCancellationIdempotencyKey", 512),
+	providerOperationId: Schema.NullOr(PluginProviderOperationId),
+	reconciliationKey: Schema.NullOr(PluginActionReconciliationKey)
+}).check(Schema.makeFilter(({ providerOperationId, reconciliationKey }) => providerOperationId === null !== (reconciliationKey === null), { expected: "exactly one provider operation or reconciliation key" }));
+/** Truthful cancellation response; provider completion may win the race. */
+var PluginActionCancellationResultV1 = Schema.Union([
+	Schema.TaggedStruct("cancelled", { receipt: PluginProviderReceiptV1 }).check(Schema.makeFilter(({ receipt }) => receipt.status === "cancelled", { expected: "a cancelled provider receipt" })),
+	Schema.TaggedStruct("completed", { receipt: PluginProviderReceiptV1 }).check(Schema.makeFilter(({ receipt }) => receipt.status === "succeeded" || receipt.status === "failed", { expected: "a terminal succeeded or failed provider receipt" })),
+	Schema.TaggedStruct("unknown", {
+		reconciliationKey: PluginActionReconciliationKey,
+		observedAt: UtcTimestamp
+	})
+]).pipe(Schema.toTaggedUnion("_tag"));
+/** Request to reconcile without replay; null locates the mutation by its durable idempotency key. */
+var PluginActionReconciliationRequestV1 = Schema.Struct({
+	reconciliationKey: Schema.NullOr(PluginActionReconciliationKey),
+	idempotencyKey: boundedOpaque("PluginReconciliationIdempotencyKey", 512),
+	payloadDigest: PluginActionPayloadDigest
+});
+/** Reconciled provider state. Cancelled means the mutation provably did not occur. */
+var PluginActionReconciliationResultV1 = Schema.Union([
+	Schema.TaggedStruct("pending", { checkedAt: UtcTimestamp }),
+	Schema.TaggedStruct("succeeded", { receipt: PluginProviderReceiptV1 }).check(Schema.makeFilter(({ receipt }) => receipt.status === "succeeded", { expected: "a succeeded provider receipt" })),
+	Schema.TaggedStruct("failed", { receipt: PluginProviderReceiptV1 }).check(Schema.makeFilter(({ receipt }) => receipt.status === "failed", { expected: "a failed provider receipt" })),
+	Schema.TaggedStruct("cancelled", { receipt: PluginProviderReceiptV1 }).check(Schema.makeFilter(({ receipt }) => receipt.status === "cancelled", { expected: "a cancelled provider receipt" }))
+]).pipe(Schema.toTaggedUnion("_tag"));
+//#endregion
+//#region src/domain/governedAction/model.ts
+var PositiveInteger$1 = Schema.Int.check(Schema.isGreaterThan(0));
+var boundedIdentifier$1 = (name, maximumLength) => Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(maximumLength), Schema.isPattern(/^[A-Za-z0-9._:/-]+$/u, { expected: "a bounded action identifier" })).pipe(Schema.brand(name));
+var sha256Digest = (name) => Schema.String.check(Schema.isPattern(/^sha256:[0-9a-f]{64}$/u, { expected: "a lowercase SHA-256 digest" })).pipe(Schema.brand(name));
+var compareText = (left, right) => left < right ? -1 : left > right ? 1 : 0;
+var isCanonicalText = (values) => values.every((value, index) => index === 0 || compareText(values[index - 1] ?? "", value) < 0);
+/** Digest of every immutable field in a governed action envelope. */
+var GovernedActionEnvelopeDigest = sha256Digest("GovernedActionEnvelopeDigest");
+/** Digest of the canonical evidence-reference set bound to an action. */
+var GovernedActionEvidenceSetDigest = sha256Digest("GovernedActionEvidenceSetDigest");
+/** Digest of a fresh policy evaluation persisted with one exact dispatch attempt. */
+var GovernedActionPolicyEvaluationDigest = sha256Digest("GovernedActionPolicyEvaluationDigest");
+/** Digest of every immutable field in one human action authorization. */
+var GovernedActionAuthorizationDigest = sha256Digest("GovernedActionAuthorizationDigest");
+/** Digest of every immutable field in one durable dispatch attempt. */
+var GovernedActionAttemptDigest = sha256Digest("GovernedActionAttemptDigest");
+/** Digest of the exact versioned policy snapshot used for authorization. */
+var GovernedActionPolicyDigest = sha256Digest("GovernedActionPolicyDigest");
+/** Stable identity of one governed-action policy family. */
+var GovernedActionPolicyId = boundedIdentifier$1("GovernedActionPolicyId", 200);
+/** Workspace-connection scoped key that deduplicates one governed provider mutation. */
+var GovernedActionIdempotencyKey = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(512)).pipe(Schema.brand("GovernedActionIdempotencyKey"));
+/** Optimistic revision of the exact configured plugin connection authorized for dispatch. */
+var GovernedActionPluginConnectionRevision = PositiveInteger$1.pipe(Schema.brand("GovernedActionPluginConnectionRevision"));
+/** Non-secret digest that changes with configuration, credentials, or resolved provider account. */
+var GovernedActionPluginConnectionAuthorityDigest = sha256Digest("GovernedActionPluginConnectionAuthorityDigest");
+/** Versioned policy and permission snapshot bound into an action proposal. */
+var GovernedActionPolicyBinding = Schema.Struct({
+	policyId: GovernedActionPolicyId,
+	policyVersion: PositiveInteger$1,
+	policyDigest: GovernedActionPolicyDigest,
+	requiredPermission: Role
+});
+/** Fresh policy result recomputed immediately before a provider mutation may dispatch. */
+var GovernedActionPolicyEvaluationV1 = Schema.Struct({
+	schemaVersion: Schema.Literal(1),
+	actionId: GovernedActionId,
+	workspaceId: WorkspaceId,
+	policy: GovernedActionPolicyBinding,
+	payloadDigest: PluginActionPayloadDigest,
+	evidenceSetDigest: GovernedActionEvidenceSetDigest,
+	expectedRevision: Revision,
+	decision: Schema.Literals(["allowed", "denied"]),
+	evaluatedAt: UtcTimestamp
+});
+/** Current normalized target and exact provider provenance checked before dispatch. */
+var GovernedActionTargetSnapshotV1 = Schema.Struct({
+	workspaceId: WorkspaceId,
+	entityId: EntityId,
+	entityType: PluginEntityType,
+	sourceRevision: SourceRevision
+});
+/** Exact immutable evidence state considered by policy at proposal time. */
+var GovernedActionEvidenceReference = Schema.Struct({
+	workspaceId: WorkspaceId,
+	evidenceId: EvidenceId,
+	evidenceClaimIds: Schema.Array(EvidenceClaimId).check(Schema.isUnique(), Schema.makeFilter(isCanonicalText, { expected: "evidence claim identities in canonical order" }), Schema.makeFilter((evidenceClaimIds) => evidenceClaimIds.length <= 100, { expected: "at most 100 evidence claims per evidence item" })),
+	observedAt: UtcTimestamp,
+	validUntil: Schema.NullOr(UtcTimestamp),
+	currentUntil: Schema.NullOr(UtcTimestamp),
+	evaluatedAt: UtcTimestamp,
+	source: Schema.Literals([
+		"current",
+		"stale",
+		"missing",
+		"unavailable"
+	]),
+	validity: Schema.Literals(["valid", "expired"])
+}).check(Schema.makeFilter(({ evaluatedAt, observedAt }) => DateTime.Order(observedAt, evaluatedAt) <= 0, { expected: "evidence evaluation not to precede observation" }), Schema.makeFilter(({ observedAt, validUntil }) => validUntil === null || DateTime.Order(observedAt, validUntil) < 0, { expected: "evidence validity to end after observation" }), Schema.makeFilter(({ currentUntil, observedAt }) => currentUntil === null || DateTime.Order(observedAt, currentUntil) < 0, { expected: "evidence freshness to end after observation" }), Schema.makeFilter(({ currentUntil, evaluatedAt, source }) => {
+	if (source === "current") return currentUntil === null || DateTime.Order(evaluatedAt, currentUntil) < 0;
+	if (source === "stale") return currentUntil !== null && DateTime.Order(evaluatedAt, currentUntil) >= 0;
+	return currentUntil === null;
+}, { expected: "evidence source state to match its evaluation and freshness window" }), Schema.makeFilter(({ evaluatedAt, validUntil, validity }) => {
+	return validity === (validUntil === null || DateTime.Order(evaluatedAt, validUntil) < 0 ? "valid" : "expired");
+}, { expected: "evidence validity to match its evaluation and validity window" }));
+/** Human or agent provenance for a proposal; neither form grants execution authority. */
+var GovernedActionProposalOrigin = Schema.TaggedUnion({
+	human: {
+		actor: HumanActor,
+		sessionId: SessionId
+	},
+	agent: {
+		actor: AgentActor,
+		jobId: JobId,
+		initiatingSessionId: Schema.NullOr(SessionId)
+	}
+});
+var canonicalEvidenceReferences = Schema.makeFilter((evidence) => isCanonicalText(evidence.map(({ evidenceId }) => evidenceId)), { expected: "unique evidence references in canonical evidence-id order" });
+/** Bounded canonical set of immutable evidence references used by action authority. */
+var GovernedActionEvidenceSet = Schema.Array(GovernedActionEvidenceReference).check(Schema.makeFilter((evidence) => evidence.length <= 100, { expected: "at most 100 evidence references" }), canonicalEvidenceReferences);
+var governedActionEnvelopeMaterialFields = {
+	schemaVersion: Schema.Literal(1),
+	actionId: GovernedActionId,
+	idempotencyKey: GovernedActionIdempotencyKey,
+	workspaceId: WorkspaceId,
+	pluginConnectionId: PluginConnectionId,
+	pluginConnectionRevision: GovernedActionPluginConnectionRevision,
+	pluginConnectionAuthorityDigest: GovernedActionPluginConnectionAuthorityDigest,
+	pluginId: PluginId,
+	pluginContractVersion: SemanticVersion,
+	pluginAdapterVersion: SemanticVersion,
+	providerId: ProviderId,
+	capability: Schema.Struct({
+		capabilityId: Schema.Literal("action.execute"),
+		version: PositiveInteger$1
+	}),
+	targetEntityId: EntityId,
+	proposal: PluginActionProposalV1,
+	evidence: GovernedActionEvidenceSet,
+	evidenceSetDigest: GovernedActionEvidenceSetDigest,
+	policy: GovernedActionPolicyBinding,
+	origin: GovernedActionProposalOrigin,
+	proposalExpiresAt: UtcTimestamp,
+	causationId: Schema.NullOr(DomainEventId),
+	correlationId: Schema.NullOr(DomainEventCorrelationId)
+};
+/** Complete digest-free material used to derive an immutable action envelope identity. */
+var GovernedActionEnvelopeMaterialV1 = Schema.Struct(governedActionEnvelopeMaterialFields).check(Schema.makeFilter(({ capability, proposal }) => capability.version === proposal.capabilityVersion, { expected: "envelope capability version to match the proposal capability version" }), Schema.makeFilter(({ proposal, proposalExpiresAt }) => DateTime.Order(proposal.proposedAt, proposalExpiresAt) < 0, { expected: "action proposal to expire after it is created" }), Schema.makeFilter(({ evidence, workspaceId }) => evidence.every((reference) => reference.workspaceId === workspaceId), { expected: "every governed-action evidence reference to belong to the action workspace" }));
+/** Immutable, versioned host authority for one proposed provider mutation. */
+var GovernedActionEnvelopeV1 = Schema.Struct({
+	...governedActionEnvelopeMaterialFields,
+	envelopeDigest: GovernedActionEnvelopeDigest
+}).check(Schema.makeFilter(({ capability, proposal }) => capability.version === proposal.capabilityVersion, { expected: "envelope capability version to match the proposal capability version" }), Schema.makeFilter(({ proposal, proposalExpiresAt }) => DateTime.Order(proposal.proposedAt, proposalExpiresAt) < 0, { expected: "action proposal to expire after it is created" }), Schema.makeFilter(({ evidence, workspaceId }) => evidence.every((reference) => reference.workspaceId === workspaceId), { expected: "every governed-action evidence reference to belong to the action workspace" }));
+/** Human authorization bound to the complete immutable action and policy inputs. */
+var GovernedActionAuthorizationV1 = Schema.Struct({
+	schemaVersion: Schema.Literal(1),
+	authorizationId: GovernedActionAuthorizationId,
+	actionId: GovernedActionId,
+	workspaceId: WorkspaceId,
+	pluginConnectionId: PluginConnectionId,
+	pluginConnectionRevision: GovernedActionPluginConnectionRevision,
+	pluginConnectionAuthorityDigest: GovernedActionPluginConnectionAuthorityDigest,
+	actionEnvelopeDigest: GovernedActionEnvelopeDigest,
+	idempotencyKey: GovernedActionIdempotencyKey,
+	payloadDigest: PluginActionPayloadDigest,
+	evidenceSetDigest: GovernedActionEvidenceSetDigest,
+	policyDigest: GovernedActionPolicyDigest,
+	expectedRevision: Revision,
+	capabilityVersion: PositiveInteger$1,
+	actor: HumanActor,
+	sessionId: SessionId,
+	sessionPermission: Role,
+	sessionExpiresAt: UtcTimestamp,
+	requiredPermission: Role,
+	authorizedAt: UtcTimestamp,
+	expiresAt: UtcTimestamp
+}).check(Schema.makeFilter(({ authorizedAt, expiresAt }) => DateTime.Order(authorizedAt, expiresAt) < 0, { expected: "governed-action authorization to expire after it is issued" }), Schema.makeFilter(({ expiresAt, sessionExpiresAt }) => DateTime.Order(expiresAt, sessionExpiresAt) <= 0, { expected: "governed-action authorization not to outlive its authenticated session" }));
+/** Durable dispatch intent created only after an exact ready preflight. */
+var GovernedActionAttemptV1 = Schema.Struct({
+	schemaVersion: Schema.Literal(1),
+	attemptId: GovernedActionAttemptId,
+	authorizationId: GovernedActionAuthorizationId,
+	actionId: GovernedActionId,
+	workspaceId: WorkspaceId,
+	pluginConnectionId: PluginConnectionId,
+	idempotencyKey: GovernedActionIdempotencyKey,
+	attemptNumber: Schema.Literal(1),
+	actionEnvelopeDigest: GovernedActionEnvelopeDigest,
+	expectedRevision: Revision,
+	policyEvaluationDigest: GovernedActionPolicyEvaluationDigest,
+	preflight: ReadyPluginActionPreflightV1,
+	startedAt: UtcTimestamp
+}).check(Schema.makeFilter(({ expectedRevision, preflight }) => expectedRevision === preflight.checkedRevision, { expected: "dispatch intent revision to match the ready preflight revision" }), Schema.makeFilter(({ preflight, startedAt }) => DateTime.Order(preflight.checkedAt, startedAt) <= 0, { expected: "dispatch intent not to precede its ready preflight" }));
+//#endregion
+//#region src/domain/governedAction/bindings.ts
+/** Closed reasons why durable authorization or dispatch intent does not match its action. */
+var GovernedActionAuthorityMismatch = Schema.Literals([
+	"authorization-action-mismatch",
+	"authorization-workspace-mismatch",
+	"authorization-connection-mismatch",
+	"authorization-connection-revision-mismatch",
+	"authorization-connection-authority-mismatch",
+	"authorization-envelope-mismatch",
+	"authorization-idempotency-mismatch",
+	"authorization-payload-mismatch",
+	"authorization-evidence-mismatch",
+	"authorization-policy-mismatch",
+	"authorization-revision-mismatch",
+	"authorization-capability-mismatch",
+	"authorization-permission-mismatch",
+	"authorization-outside-proposal-window",
+	"authorization-expired",
+	"authorization-session-expired",
+	"evidence-not-current",
+	"evidence-set-changed",
+	"evidence-workspace-mismatch",
+	"session-id-mismatch",
+	"session-actor-mismatch",
+	"session-workspace-mismatch",
+	"session-permission-mismatch",
+	"session-revoked",
+	"authorization-session-chronology",
+	"current-plugin-connection-mismatch",
+	"current-plugin-workspace-mismatch",
+	"current-plugin-provider-mismatch",
+	"current-plugin-revision-mismatch",
+	"current-plugin-authority-mismatch",
+	"current-plugin-unavailable",
+	"current-plugin-mismatch",
+	"current-capability-unavailable",
+	"current-capability-version-mismatch",
+	"current-policy-denied",
+	"current-policy-mismatch",
+	"current-target-workspace-mismatch",
+	"current-target-entity-mismatch",
+	"current-target-type-mismatch",
+	"current-target-source-mismatch",
+	"current-target-revision-mismatch",
+	"attempt-action-mismatch",
+	"attempt-authorization-mismatch",
+	"attempt-workspace-mismatch",
+	"attempt-connection-mismatch",
+	"attempt-envelope-mismatch",
+	"attempt-idempotency-mismatch",
+	"attempt-policy-evaluation-mismatch",
+	"attempt-revision-mismatch",
+	"attempt-outside-authorization-window"
+]);
+/** Complete aggregate authority checked immediately before durable dispatch intent. */
+var GovernedActionAuthorityBindingInput = Schema.Struct({
+	envelope: GovernedActionEnvelopeV1,
+	authorization: GovernedActionAuthorizationV1,
+	attempt: GovernedActionAttemptV1,
+	evaluatedAt: UtcTimestamp
+});
+/** Immutable authorization inputs that can be verified before a dispatch attempt exists. */
+var GovernedActionAuthorizationBindingInput = Schema.Struct({
+	envelope: GovernedActionEnvelopeV1,
+	authorization: GovernedActionAuthorizationV1
+});
+/** Explicit V1 permission implication: workspace owner or an exact scoped role. */
+var governedActionPermissionGrants = (sessionPermission, requiredPermission) => sessionPermission === "workspace-owner" || sessionPermission === requiredPermission;
+/** Return every fail-closed mismatch between an envelope and its human grant. */
+var governedActionAuthorizationMismatches = ({ authorization, envelope }) => {
+	const mismatches = [];
+	const addMismatch = (condition, mismatch) => {
+		if (condition) mismatches.push(mismatch);
+	};
+	addMismatch(authorization.actionId !== envelope.actionId, "authorization-action-mismatch");
+	addMismatch(authorization.workspaceId !== envelope.workspaceId, "authorization-workspace-mismatch");
+	addMismatch(authorization.pluginConnectionId !== envelope.pluginConnectionId, "authorization-connection-mismatch");
+	addMismatch(authorization.pluginConnectionRevision !== envelope.pluginConnectionRevision, "authorization-connection-revision-mismatch");
+	addMismatch(authorization.pluginConnectionAuthorityDigest !== envelope.pluginConnectionAuthorityDigest, "authorization-connection-authority-mismatch");
+	addMismatch(authorization.actionEnvelopeDigest !== envelope.envelopeDigest, "authorization-envelope-mismatch");
+	addMismatch(authorization.idempotencyKey !== envelope.idempotencyKey, "authorization-idempotency-mismatch");
+	addMismatch(authorization.payloadDigest !== envelope.proposal.payloadDigest, "authorization-payload-mismatch");
+	addMismatch(authorization.evidenceSetDigest !== envelope.evidenceSetDigest, "authorization-evidence-mismatch");
+	addMismatch(authorization.policyDigest !== envelope.policy.policyDigest, "authorization-policy-mismatch");
+	addMismatch(authorization.expectedRevision !== envelope.proposal.request.expectedRevision, "authorization-revision-mismatch");
+	addMismatch(authorization.capabilityVersion !== envelope.capability.version, "authorization-capability-mismatch");
+	addMismatch(authorization.requiredPermission !== envelope.policy.requiredPermission, "authorization-permission-mismatch");
+	addMismatch(!governedActionPermissionGrants(authorization.sessionPermission, authorization.requiredPermission), "authorization-permission-mismatch");
+	addMismatch(DateTime.Order(authorization.authorizedAt, envelope.proposal.proposedAt) < 0 || DateTime.Order(authorization.authorizedAt, envelope.proposalExpiresAt) >= 0 || DateTime.Order(authorization.expiresAt, envelope.proposalExpiresAt) > 0, "authorization-outside-proposal-window");
+	return mismatches;
+};
+/** Whether a human grant is attributable to its exact immutable authorize transition. */
+var governedActionAuthorizationMatchesTransition = (authorization, transition) => transition.command._tag === "authorize" && transition.command.authorizationId === authorization.authorizationId && transition.actionId === authorization.actionId && transition.workspaceId === authorization.workspaceId && transition.actionEnvelopeDigest === authorization.actionEnvelopeDigest && DateTime.Order(transition.occurredAt, authorization.authorizedAt) === 0 && transition.cause._tag === "human" && transition.cause.actor.personId === authorization.actor.personId && transition.cause.sessionId === authorization.sessionId;
+/** Return every fail-closed mismatch between an envelope, human grant, and dispatch intent. */
+var governedActionAuthorityMismatches = ({ attempt, authorization, envelope, evaluatedAt }) => {
+	const mismatches = [...governedActionAuthorizationMismatches({
+		authorization,
+		envelope
+	})];
+	const addMismatch = (condition, mismatch) => {
+		if (condition) mismatches.push(mismatch);
+	};
+	addMismatch(DateTime.Order(evaluatedAt, authorization.expiresAt) >= 0 || DateTime.Order(evaluatedAt, envelope.proposalExpiresAt) >= 0, "authorization-expired");
+	addMismatch(DateTime.Order(evaluatedAt, authorization.sessionExpiresAt) >= 0, "authorization-session-expired");
+	addMismatch(envelope.evidence.some(({ currentUntil, source, validUntil }) => source !== "current" || currentUntil !== null && DateTime.Order(evaluatedAt, currentUntil) >= 0 || validUntil !== null && DateTime.Order(evaluatedAt, validUntil) >= 0), "evidence-not-current");
+	addMismatch(attempt.actionId !== envelope.actionId, "attempt-action-mismatch");
+	addMismatch(attempt.authorizationId !== authorization.authorizationId, "attempt-authorization-mismatch");
+	addMismatch(attempt.workspaceId !== envelope.workspaceId, "attempt-workspace-mismatch");
+	addMismatch(attempt.pluginConnectionId !== envelope.pluginConnectionId, "attempt-connection-mismatch");
+	addMismatch(attempt.actionEnvelopeDigest !== envelope.envelopeDigest, "attempt-envelope-mismatch");
+	addMismatch(attempt.idempotencyKey !== envelope.idempotencyKey, "attempt-idempotency-mismatch");
+	addMismatch(attempt.expectedRevision !== envelope.proposal.request.expectedRevision, "attempt-revision-mismatch");
+	addMismatch(DateTime.Order(attempt.preflight.checkedAt, authorization.authorizedAt) < 0 || DateTime.Order(attempt.startedAt, authorization.authorizedAt) < 0 || DateTime.Order(attempt.startedAt, authorization.expiresAt) >= 0 || DateTime.Order(attempt.startedAt, envelope.proposalExpiresAt) >= 0 || DateTime.Order(attempt.startedAt, evaluatedAt) > 0, "attempt-outside-authorization-window");
+	return mismatches;
+};
+//#endregion
+//#region src/domain/governedAction/stateMachine.ts
+var PositiveInteger = Schema.Int.check(Schema.isGreaterThan(0));
+var SafeReason = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(1e3));
+var boundedIdentifier = (name, maximumLength) => Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(maximumLength), Schema.isPattern(/^[A-Za-z0-9._:/-]+$/u, { expected: "a bounded action identifier" })).pipe(Schema.brand(name));
+/** Complete persisted lifecycle states for a governed action. */
+var GovernedActionState = Schema.Literals([
+	"proposed",
+	"authorized",
+	"denied",
+	"expired",
+	"cancelled",
+	"started",
+	"cancel-requested",
+	"cancel-requested-unknown",
+	"succeeded",
+	"failed",
+	"unknown"
+]);
+/** Stable identity supplied by a caller to deduplicate one lifecycle command. */
+var GovernedActionCommandId = boundedIdentifier("GovernedActionCommandId", 512);
+/** Digest of one canonical transition command used to reject changed command retries. */
+var GovernedActionCommandDigest = Schema.String.check(Schema.isPattern(/^sha256:[0-9a-f]{64}$/u, { expected: "a lowercase SHA-256 digest" })).pipe(Schema.brand("GovernedActionCommandDigest"));
+/** Digest of every immutable field in one governed-action transition. */
+var GovernedActionTransitionDigest = Schema.String.check(Schema.isPattern(/^sha256:[0-9a-f]{64}$/u, { expected: "a lowercase SHA-256 digest" })).pipe(Schema.brand("GovernedActionTransitionDigest"));
+/** Closed reason why authorization or preflight failed without calling a provider. */
+var GovernedActionDenialReason = Schema.Literals([
+	"revision-changed",
+	"evidence-stale",
+	"evidence-invalid",
+	"policy-denied",
+	"session-invalid",
+	"capability-changed",
+	"plugin-unavailable",
+	"preflight-blocked"
+]);
+/** Unknown provider outcome that is either safely reconcilable or explicitly manual. */
+var GovernedActionUnknownOutcome = Schema.TaggedUnion({
+	reconcilable: {
+		reconciliationKey: PluginActionReconciliationKey,
+		observedAt: UtcTimestamp,
+		safeSummary: SafeReason
+	},
+	manual: {
+		observedAt: UtcTimestamp,
+		safeSummary: SafeReason,
+		reason: Schema.Literals([
+			"dispatch-deadline-exceeded",
+			"interrupted-after-intent",
+			"provider-defect-after-intent",
+			"malformed-provider-result",
+			"receipt-persistence-failed",
+			"missing-reconciliation-locator"
+		])
+	}
+});
+var SucceededReceipt = PluginTerminalProviderReceiptV1.check(Schema.makeFilter(({ status }) => status === "succeeded", { expected: "a succeeded provider receipt" }));
+var FailedReceipt = PluginTerminalProviderReceiptV1.check(Schema.makeFilter(({ status }) => status === "failed", { expected: "a failed provider receipt" }));
+var CancelledReceipt = PluginTerminalProviderReceiptV1.check(Schema.makeFilter(({ status }) => status === "cancelled", { expected: "a cancelled provider receipt" }));
+/** Whether a terminal receipt came from dispatch or reconciliation by provider/idempotency identity. */
+var GovernedActionOutcomeSource = Schema.TaggedUnion({
+	direct: {},
+	providerOperation: { providerOperationId: PluginProviderOperationId },
+	reconciliation: { reconciliationKey: Schema.NullOr(PluginActionReconciliationKey) }
+});
+/** Closed commands that may append one governed-action lifecycle transition. */
+var GovernedActionTransitionCommand = Schema.TaggedUnion({
+	propose: {},
+	authorize: { authorizationId: GovernedActionAuthorizationId },
+	deny: {
+		reason: GovernedActionDenialReason,
+		safeSummary: SafeReason
+	},
+	expire: { reason: Schema.Literals(["proposal-expired", "authorization-expired"]) },
+	cancel: { safeSummary: SafeReason },
+	start: { attemptId: GovernedActionAttemptId },
+	requestCancellation: { safeSummary: SafeReason },
+	recordAccepted: { receipt: PluginAcceptedProviderReceiptV1 },
+	recordSucceeded: {
+		receipt: SucceededReceipt,
+		source: GovernedActionOutcomeSource
+	},
+	recordFailed: {
+		receipt: FailedReceipt,
+		source: GovernedActionOutcomeSource
+	},
+	recordUnknown: { outcome: GovernedActionUnknownOutcome },
+	recordCancelled: {
+		receipt: CancelledReceipt,
+		source: GovernedActionOutcomeSource
+	},
+	reconciliationPending: {
+		checkedAt: UtcTimestamp,
+		reconciliationKey: Schema.NullOr(PluginActionReconciliationKey)
+	}
+});
+/** Attributable human, agent, or internal component responsible for a transition. */
+var GovernedActionTransitionCause = Schema.TaggedUnion({
+	human: {
+		actor: HumanActor,
+		sessionId: SessionId
+	},
+	agent: {
+		actor: AgentActor,
+		jobId: JobId
+	},
+	system: { component: boundedIdentifier("GovernedActionSystemComponent", 200) }
+});
+var canRecordTerminalOutcome = (currentState, source) => currentState === "started" || currentState === "cancel-requested" || (currentState === "unknown" || currentState === "cancel-requested-unknown") && source._tag === "reconciliation";
+/**
+* Resolve a lifecycle command without side effects.
+* A null result means the command is not legal from the supplied state.
+*/
+var reduceGovernedActionState = (currentState, command) => {
+	switch (command._tag) {
+		case "propose": return currentState === null ? "proposed" : null;
+		case "authorize": return currentState === "proposed" ? "authorized" : null;
+		case "deny": return currentState === "proposed" || currentState === "authorized" ? "denied" : null;
+		case "expire": return currentState === "proposed" || currentState === "authorized" ? "expired" : null;
+		case "cancel": return currentState === "proposed" || currentState === "authorized" ? "cancelled" : null;
+		case "start": return currentState === "authorized" ? "started" : null;
+		case "requestCancellation": return currentState === "started" ? "cancel-requested" : currentState === "unknown" ? "cancel-requested-unknown" : null;
+		case "recordAccepted": return currentState === "started" || currentState === "cancel-requested" ? currentState : null;
+		case "recordUnknown": return currentState === "started" ? "unknown" : currentState === "cancel-requested" ? "cancel-requested-unknown" : null;
+		case "recordSucceeded": return canRecordTerminalOutcome(currentState, command.source) ? "succeeded" : null;
+		case "recordFailed": return canRecordTerminalOutcome(currentState, command.source) ? "failed" : null;
+		case "recordCancelled": return canRecordTerminalOutcome(currentState, command.source) ? "cancelled" : null;
+		case "reconciliationPending": return currentState === "started" || currentState === "cancel-requested" || currentState === "unknown" || currentState === "cancel-requested-unknown" ? currentState : null;
+	}
+};
+/** Whether a governed action has reached a state that cannot execute more provider work. */
+var isGovernedActionTerminalState = (state) => state === "denied" || state === "expired" || state === "cancelled" || state === "succeeded" || state === "failed";
+var commandCauseIsAllowed = (command, cause) => {
+	switch (cause._tag) {
+		case "agent": return command._tag === "propose";
+		case "human": return command._tag === "propose" || command._tag === "authorize" || command._tag === "deny" || command._tag === "cancel" || command._tag === "requestCancellation";
+		case "system": return command._tag === "deny" || command._tag === "expire" || command._tag === "cancel" || command._tag === "start" || command._tag === "requestCancellation" || command._tag === "recordAccepted" || command._tag === "recordSucceeded" || command._tag === "recordFailed" || command._tag === "recordUnknown" || command._tag === "recordCancelled" || command._tag === "reconciliationPending";
+	}
+};
+var governedActionTransitionMaterialFields = {
+	schemaVersion: Schema.Literal(1),
+	transitionId: GovernedActionTransitionId,
+	previousTransitionId: Schema.NullOr(GovernedActionTransitionId),
+	commandId: GovernedActionCommandId,
+	actionId: GovernedActionId,
+	workspaceId: WorkspaceId,
+	sequence: PositiveInteger,
+	fromState: Schema.NullOr(GovernedActionState),
+	toState: GovernedActionState,
+	actionEnvelopeDigest: GovernedActionEnvelopeDigest,
+	command: GovernedActionTransitionCommand,
+	cause: GovernedActionTransitionCause,
+	occurredAt: UtcTimestamp,
+	causationId: Schema.NullOr(DomainEventId),
+	correlationId: Schema.NullOr(DomainEventCorrelationId)
+};
+/** Digest-free transition fields used only by the trusted transition constructor. */
+var GovernedActionTransitionMaterialV1 = Schema.Struct(governedActionTransitionMaterialFields).check(Schema.makeFilter(({ command, fromState, toState }) => reduceGovernedActionState(fromState, command) === toState, { expected: "a legal governed-action state transition" }), Schema.makeFilter(({ cause, command }) => commandCauseIsAllowed(command, cause), { expected: "transition cause to have authority for the command" }), Schema.makeFilter(({ fromState, previousTransitionId, sequence }) => sequence === 1 ? fromState === null && previousTransitionId === null : fromState !== null && previousTransitionId !== null, { expected: "the first transition to be the only transition without a predecessor" }));
+/** Immutable append-only audit record for one legal lifecycle command. */
+var GovernedActionTransitionV1 = Schema.Struct({
+	...governedActionTransitionMaterialFields,
+	commandDigest: GovernedActionCommandDigest
+}).check(Schema.makeFilter(({ command, fromState, toState }) => reduceGovernedActionState(fromState, command) === toState, { expected: "a legal governed-action state transition" }), Schema.makeFilter(({ cause, command }) => commandCauseIsAllowed(command, cause), { expected: "transition cause to have authority for the command" }), Schema.makeFilter(({ fromState, previousTransitionId, sequence }) => sequence === 1 ? fromState === null && previousTransitionId === null : fromState !== null && previousTransitionId !== null, { expected: "the first transition to be the only transition without a predecessor" }));
+//#endregion
+//#region src/domain/governedAction/lifecycle.ts
+/** Provider identity retained by the durable action head across async and ambiguous work. */
+var GovernedActionProviderLineage = Schema.TaggedUnion({
+	none: {},
+	accepted: { receipt: PluginAcceptedProviderReceiptV1 },
+	reconcilable: {
+		providerOperationId: Schema.NullOr(PluginProviderOperationId),
+		reconciliationKey: PluginActionReconciliationKey
+	},
+	manual: { providerOperationId: Schema.NullOr(PluginProviderOperationId) },
+	terminal: { receipt: PluginTerminalProviderReceiptV1 }
+});
+var stateMatchesLineage = (state, lineage) => {
+	switch (state) {
+		case "proposed":
+		case "authorized":
+		case "denied":
+		case "expired": return lineage._tag === "none";
+		case "cancelled": return lineage._tag === "none" || lineage._tag === "terminal" && lineage.receipt.status === "cancelled";
+		case "started":
+		case "cancel-requested": return lineage._tag === "none" || lineage._tag === "accepted";
+		case "unknown":
+		case "cancel-requested-unknown": return lineage._tag === "reconcilable" || lineage._tag === "manual";
+		case "succeeded": return lineage._tag === "terminal" && lineage.receipt.status === "succeeded";
+		case "failed": return lineage._tag === "terminal" && lineage.receipt.status === "failed";
+	}
+};
+/** Durable lifecycle state plus the exact provider identity needed for safe recovery. */
+var GovernedActionLifecycleHeadV1 = Schema.Struct({
+	state: GovernedActionState,
+	lineage: GovernedActionProviderLineage
+}).check(Schema.makeFilter(({ lineage, state }) => stateMatchesLineage(state, lineage), { expected: "governed-action state and provider lineage to agree" }));
+var providerOperationIdFromLineage = (lineage) => {
+	switch (lineage._tag) {
+		case "accepted": return lineage.receipt.providerOperationId;
+		case "reconcilable":
+		case "manual": return lineage.providerOperationId;
+		case "none":
+		case "terminal": return null;
+	}
+};
+var reconciliationKeyFromLineage = (lineage) => {
+	switch (lineage._tag) {
+		case "accepted": return lineage.receipt.reconciliationKey;
+		case "reconcilable": return lineage.reconciliationKey;
+		case "none":
+		case "manual":
+		case "terminal": return null;
+	}
+};
+var unknownLineage = (current, command) => {
+	const providerOperationId = providerOperationIdFromLineage(current);
+	if (command.outcome._tag === "reconcilable") return {
+		_tag: "reconcilable",
+		providerOperationId,
+		reconciliationKey: command.outcome.reconciliationKey
+	};
+	const retainedReconciliationKey = reconciliationKeyFromLineage(current);
+	return retainedReconciliationKey === null ? {
+		_tag: "manual",
+		providerOperationId
+	} : {
+		_tag: "reconcilable",
+		providerOperationId,
+		reconciliationKey: retainedReconciliationKey
+	};
+};
+var acceptedReceiptMatches = (lineage, command) => lineage._tag === "none" || lineage._tag === "accepted" && lineage.receipt.providerOperationId === command.receipt.providerOperationId && lineage.receipt.reconciliationKey === command.receipt.reconciliationKey;
+/** Null is the action envelope's immutable idempotency identity, never a missing provider key. */
+var reconciliationLocatorMatches = (lineage, reconciliationKey) => reconciliationKey === null ? lineage._tag === "none" || lineage._tag === "manual" : reconciliationKeyFromLineage(lineage) === reconciliationKey;
+var terminalSourceMatches = (lineage, command) => {
+	const providerOperationId = providerOperationIdFromLineage(lineage);
+	switch (command.source._tag) {
+		case "direct": return lineage._tag === "none";
+		case "providerOperation": return providerOperationId !== null && command.source.providerOperationId === providerOperationId && command.receipt.providerOperationId === providerOperationId;
+		case "reconciliation": return reconciliationLocatorMatches(lineage, command.source.reconciliationKey) && (providerOperationId === null || command.receipt.providerOperationId === providerOperationId);
+	}
+};
+var reconciliationPendingMatches = (lineage, command) => reconciliationLocatorMatches(lineage, command.reconciliationKey);
+/**
+* Advance a durable lifecycle head while retaining and matching opaque provider identity.
+* A null result rejects illegal edges, fabricated locators, and unrelated receipts.
+*/
+var advanceGovernedActionLifecycle = (current, command) => {
+	const nextState = reduceGovernedActionState(current?.state ?? null, command);
+	if (nextState === null) return null;
+	const currentLineage = current?.lineage ?? { _tag: "none" };
+	switch (command._tag) {
+		case "recordAccepted": return acceptedReceiptMatches(currentLineage, command) ? {
+			state: nextState,
+			lineage: {
+				_tag: "accepted",
+				receipt: command.receipt
+			}
+		} : null;
+		case "recordUnknown": return {
+			state: nextState,
+			lineage: unknownLineage(currentLineage, command)
+		};
+		case "recordSucceeded":
+		case "recordFailed":
+		case "recordCancelled": return terminalSourceMatches(currentLineage, command) ? {
+			state: nextState,
+			lineage: {
+				_tag: "terminal",
+				receipt: command.receipt
+			}
+		} : null;
+		case "reconciliationPending": return reconciliationPendingMatches(currentLineage, command) ? {
+			state: nextState,
+			lineage: currentLineage
+		} : null;
+		case "propose":
+		case "authorize":
+		case "deny":
+		case "expire":
+		case "cancel":
+		case "start":
+		case "requestCancellation": return {
+			state: nextState,
+			lineage: currentLineage
+		};
+	}
+};
+//#endregion
+//#region src/domain/plugins/discovery.ts
+var SafeProviderIdentifier = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(512));
+var SafeProviderLabel = Schema.String.check(Schema.isTrimmed(), Schema.isNonEmpty(), Schema.isMaxLength(200));
+var SafeDiscoveryEndpointUrl = SourceUrl.pipe(Schema.check(Schema.makeFilter(({ hash, search }) => hash.length === 0 && search.length === 0, { expected: "a provider endpoint URL without query parameters or fragments" })));
+var ProviderContainer = Schema.Struct({
+	providerImmutableId: SafeProviderIdentifier,
+	displayName: SafeProviderLabel
+});
+var NullableProviderContainer = Schema.NullOr(ProviderContainer);
+/** Secret-free provider endpoint advertised during connection discovery. */
+var PluginDiscoveryEndpointV1 = Schema.Struct({
+	kind: Schema.Literals([
+		"api",
+		"web",
+		"graphql",
+		"webhook"
+	]),
+	url: SafeDiscoveryEndpointUrl,
+	label: Schema.NullOr(SafeProviderLabel)
+});
+/**
+* Safe connection metadata discovered from the provider.
+* Credentials, raw headers, and provider response bodies are deliberately absent.
+*/
+var PluginDiscoveryV1 = Schema.Struct({
+	account: NullableProviderContainer,
+	workspace: NullableProviderContainer,
+	resource: Schema.optional(NullableProviderContainer).pipe(Schema.decodeTo(Schema.toType(NullableProviderContainer), {
+		decode: SchemaGetter.withDefault(Effect.succeed(null)),
+		encode: SchemaGetter.required()
+	})),
+	endpoints: Schema.Array(PluginDiscoveryEndpointV1).check(Schema.makeFilter((endpoints) => endpoints.length <= 20, { expected: "at most 20 safe provider endpoints" })),
+	discoveredAt: UtcTimestamp
+}).annotate({ identifier: "PluginDiscoveryV1" });
+//#endregion
+//#region src/domain/readiness/material.ts
+var unique = (values) => new Set(values).size === values.length;
+var CandidateMaterialBase = {
+	workspaceId: WorkspaceId,
+	releaseRevision: ReadinessReleaseRevision,
+	artifactRevision: ReadinessArtifactRevision
+};
+var readinessFactsAreValid = (input) => {
+	const definitionsById = new Map(input.definitions.map((definition) => [definition.factId, definition]));
+	return unique(input.definitions.map(({ factId }) => factId)) && unique(input.observations.map(({ factId }) => factId)) && input.observations.every((observation) => definitionsById.get(observation.factId)?.kind === observation.state._tag) && readinessPolicyShapeIsV1(input.definitions, input.observations) && input.observations.reduce((total, observation) => total + observation.evidence.length, 0) <= 512;
+};
+/** Digest-free, complete material for one target-environment candidate. */
+var EnvironmentReadinessCandidateMaterial = Schema.Struct({
+	...CandidateMaterialBase,
+	scope: Schema.TaggedStruct("environment", {
+		releaseId: ReleaseId,
+		environmentId: EnvironmentId
+	}),
+	complete: Schema.Boolean,
+	definitions: Schema.Array(ReadinessFactDefinition).check(Schema.isMaxLength(512)),
+	observations: Schema.Array(ReadinessFactObservation).check(Schema.isMaxLength(512))
+}).check(Schema.makeFilter(readinessFactsAreValid, { expected: "complete, unique, evidence-bounded V1 readiness candidate material" }));
+/** Exact child assessment bound into a release-scope candidate. */
+var ReleaseReadinessChildMaterial = Schema.Struct({
+	assessmentId: ReadinessAssessmentId,
+	environmentId: EnvironmentId,
+	candidateDigest: ReadinessCandidateDigest
+});
+/** Digest-free material for one release candidate and its exact environment assessments. */
+var ReleaseReadinessCandidateMaterial = Schema.Struct({
+	...CandidateMaterialBase,
+	scope: Schema.TaggedStruct("release", { releaseId: ReleaseId }),
+	environments: Schema.NonEmptyArray(ReleaseReadinessChildMaterial).check(Schema.isMaxLength(512))
+}).check(Schema.makeFilter(({ environments }) => unique(environments.map(({ environmentId }) => environmentId)), { expected: "release candidate environment identities to be unique" }), Schema.makeFilter(({ environments }) => unique(environments.map(({ assessmentId }) => assessmentId)), { expected: "release candidate assessment identities to be unique" }));
+/** Digest-free immutable readiness-rule snapshot. */
+var ReadinessRuleMaterial = Schema.Struct({
+	ruleId: ReadinessRuleId,
+	version: ReadinessRuleVersion,
+	definitions: Schema.Array(ReadinessFactDefinition).check(Schema.isNonEmpty(), Schema.isMaxLength(512))
+}).check(Schema.makeFilter(({ definitions }) => unique(definitions.map(({ factId }) => factId)), { expected: "readiness rule fact identities to be unique" }), Schema.makeFilter(({ definitions }) => readinessDefinitionsShapeIsV1(definitions), { expected: "readiness rule material to contain the complete V1 policy shape" }));
+var normalizeDefinitions = (definitions) => [...definitions].sort((left, right) => compareReadinessText(left.factId, right.factId));
+var normalizeObservations = (observations) => observations.map((observation) => ({
+	...observation,
+	evidence: [...observation.evidence].sort((left, right) => compareReadinessText(left.evidenceId, right.evidenceId))
+})).sort((left, right) => compareReadinessText(left.factId, right.factId));
+/** Return the only JSON ordering accepted for environment-candidate hashing. */
+var normalizeEnvironmentReadinessCandidateMaterial = (material) => ({
+	...material,
+	definitions: normalizeDefinitions(material.definitions),
+	observations: normalizeObservations(material.observations)
+});
+/** Return the only JSON ordering accepted for release-candidate hashing. */
+var normalizeReleaseReadinessCandidateMaterial = (material) => {
+	const [first, ...remaining] = material.environments;
+	const environments = [first, ...remaining];
+	environments.sort((left, right) => compareReadinessText(left.environmentId, right.environmentId));
+	return {
+		...material,
+		environments
+	};
+};
+/** Return the only JSON ordering accepted for rule hashing. */
+var normalizeReadinessRuleMaterial = (material) => ({
+	...material,
+	definitions: normalizeDefinitions(material.definitions)
+});
+//#endregion
+//#region src/domain/readiness/rollup.ts
+/** Exact compact projection retained when an environment is rolled into a release. */
+var summarizeEnvironmentReadiness = (assessment) => ({
+	assessmentId: assessment.assessmentId,
+	environmentId: assessment.candidate.scope.environmentId,
+	candidateDigest: assessment.candidate.digest,
+	inputComplete: assessment.inputComplete,
+	facts: assessment.facts,
+	nextEvaluationAt: assessment.nextEvaluationAt,
+	verdict: assessment.verdict,
+	stages: assessment.stages,
+	blockers: assessment.blockers,
+	warnings: assessment.warnings,
+	gaps: assessment.gaps,
+	sourceFreshness: assessment.sourceFreshness,
+	evidenceIds: assessment.evidenceIds
+});
+/** Pure deterministic roll-up of current target-environment assessments. */
+var rollUpReleaseReadiness = (input) => {
+	const environments = input.environments.slice().sort((left, right) => {
+		return compareReadinessText(left.candidate.scope.environmentId, right.candidate.scope.environmentId);
+	});
+	const first = environments.reduce((earliest, assessment) => compareReadinessText(assessment.candidate.scope.environmentId, earliest.candidate.scope.environmentId) < 0 ? assessment : earliest, input.environments[0]);
+	const environmentSummaries = [summarizeEnvironmentReadiness(first), ...environments.filter((assessment) => assessment !== first).map(summarizeEnvironmentReadiness)];
+	const findings = deriveReleaseReadinessFindings(environmentSummaries);
+	return {
+		_tag: "release",
+		assessmentId: input.assessmentId,
+		previousAssessmentId: input.previousAssessmentId,
+		candidate: input.candidate,
+		rule: first.rule,
+		derivationVersion: first.derivationVersion,
+		evaluatedAt: input.evaluatedAt,
+		nextEvaluationAt: deriveReleaseReadinessNextEvaluationAt(environmentSummaries),
+		verdict: deriveReleaseReadinessVerdict(environmentSummaries),
+		stages: deriveReleaseReadinessStages(environmentSummaries),
+		environments: environmentSummaries,
+		blockers: findings.blockers,
+		warnings: findings.warnings,
+		gaps: findings.gaps,
+		sourceFreshness: deriveReleaseReadinessSourceSummaries(environmentSummaries),
+		evidenceIds: sortedReadinessUnique(environments.flatMap(({ evidenceIds }) => evidenceIds))
+	};
+};
+//#endregion
+export { GovernedActionProposalOrigin as $, GovernedActionAuthorizationBindingInput as A, PluginSyncPageV1 as At, GovernedActionEnvelopeMaterialV1 as B, GovernedActionTransitionMaterialV1 as C, PluginCheckpointV1 as Ct, reduceGovernedActionState as D, PluginEventId as Dt, isGovernedActionTerminalState as E, PluginEntityType as Et, GovernedActionAttemptDigest as F, AuthorizedShareTarget as Ft, GovernedActionIdempotencyKey as G, GovernedActionEvidenceReference as H, GovernedActionAttemptV1 as I, GovernedActionPolicyBinding as J, GovernedActionPluginConnectionAuthorityDigest as K, GovernedActionAuthorizationDigest as L, governedActionAuthorizationMatchesTransition as M, ReadPluginEntityRequestV1 as Mt, governedActionAuthorizationMismatches as N, ReadPluginEntityResultV1 as Nt, GovernedActionAuthorityBindingInput as O, PluginPageCursorV1 as Ot, governedActionPermissionGrants as P, AuthorizedShareGrant as Pt, GovernedActionPolicyId as Q, GovernedActionAuthorizationV1 as R, GovernedActionTransitionDigest as S, NormalizedPluginEventV1 as St, GovernedActionUnknownOutcome as T, PluginEntityReferenceV1 as Tt, GovernedActionEvidenceSet as U, GovernedActionEnvelopeV1 as V, GovernedActionEvidenceSetDigest as W, GovernedActionPolicyEvaluationDigest as X, GovernedActionPolicyDigest as Y, GovernedActionPolicyEvaluationV1 as Z, GovernedActionDenialReason as _, ReadyPluginActionPreflightV1 as _t, ReleaseReadinessCandidateMaterial as a, PluginActionCancellationResultV1 as at, GovernedActionTransitionCause as b, DiffInventoryPageRequestV1 as bt, normalizeReadinessRuleMaterial as c, PluginActionPreflightV1 as ct, PluginDiscoveryV1 as d, PluginActionReconciliationRequestV1 as dt, GovernedActionTargetSnapshotV1 as et, GovernedActionLifecycleHeadV1 as f, PluginActionReconciliationResultV1 as ft, GovernedActionCommandId as g, ProposePluginActionRequestV1 as gt, GovernedActionCommandDigest as h, PluginTerminalProviderReceiptV1 as ht, ReadinessRuleMaterial as i, PluginActionCancellationRequestV1 as it, governedActionAuthorityMismatches as j, PluginSyncRequestV1 as jt, GovernedActionAuthorityMismatch as k, PluginRelativePathV1 as kt, normalizeReleaseReadinessCandidateMaterial as l, PluginActionProposalV1 as lt, advanceGovernedActionLifecycle as m, PluginProviderReceiptV1 as mt, summarizeEnvironmentReadiness as n, BlockedPluginActionPreflightV1 as nt, ReleaseReadinessChildMaterial as o, PluginActionDispatchResultV1 as ot, GovernedActionProviderLineage as p, PluginProviderOperationId as pt, GovernedActionPluginConnectionRevision as q, EnvironmentReadinessCandidateMaterial as r, PluginAcceptedProviderReceiptV1 as rt, normalizeEnvironmentReadinessCandidateMaterial as s, PluginActionPayloadDigest as st, rollUpReleaseReadiness as t, AuthorizedPluginActionV1 as tt, PluginDiscoveryEndpointV1 as u, PluginActionReconciliationKey as ut, GovernedActionOutcomeSource as v, DiffContentRangeRequestV1 as vt, GovernedActionTransitionV1 as w, PluginDiffInventoryEntryV1 as wt, GovernedActionTransitionCommand as x, DiffInventoryPageV1 as xt, GovernedActionState as y, DiffContentRangeV1 as yt, GovernedActionEnvelopeDigest as z };
+
+//# sourceMappingURL=readiness-CzU3vjYQ.js.map