@knpkv/control-center 0.1.0

package/dist/server/server/governance/governedActionDigests.d.ts

@@ -0,0 +1,1348 @@
+import * as Crypto from "effect/Crypto";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { GovernedActionAttemptDigest, type GovernedActionAttemptV1 as GovernedActionAttempt, GovernedActionAuthorizationDigest, type GovernedActionAuthorizationV1 as GovernedActionAuthorization, type GovernedActionEnvelopeV1 as GovernedActionEnvelope, GovernedActionPolicyEvaluationDigest, type GovernedActionPolicyEvaluationV1 as GovernedActionPolicyEvaluation } from "../../domain/governedAction/model.js";
+import { GovernedActionTransitionDigest, type GovernedActionTransitionV1 as GovernedActionTransition } from "../../domain/governedAction/stateMachine.js";
+declare const GovernedActionDigestError_base: Schema.Class<GovernedActionDigestError, Schema.TaggedStruct<"GovernedActionDigestError", {
+    readonly operation: Schema.Literals<readonly ["encode", "encode-utf8", "digest"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Bounded failure while encoding or hashing governed-action authority. */
+export declare class GovernedActionDigestError extends GovernedActionDigestError_base {
+}
+declare const GovernedActionBindingMismatch_base: Schema.Class<GovernedActionBindingMismatch, Schema.TaggedStruct<"GovernedActionBindingMismatch", {
+    readonly reason: Schema.Literals<readonly ["payload-digest-mismatch", "evidence-set-digest-mismatch", "envelope-digest-mismatch", "command-digest-mismatch", "policy-evaluation-digest-mismatch", "authorization-digest-mismatch", "attempt-digest-mismatch", "transition-digest-mismatch"]>;
+    readonly expectedDigest: Schema.String;
+    readonly actualDigest: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** Exact immutable action binding that failed canonical verification. */
+export declare class GovernedActionBindingMismatch extends GovernedActionBindingMismatch_base {
+}
+declare class VerifiedEnvelope {
+    #private;
+    constructor(envelope: GovernedActionEnvelope);
+    /** Structurally decoded envelope whose canonical bindings were recomputed successfully. */
+    get envelope(): GovernedActionEnvelope;
+}
+/** Nominal server-only proof that an action envelope passed canonical verification. */
+export type VerifiedGovernedActionEnvelope = VerifiedEnvelope;
+declare class VerifiedTransition {
+    #private;
+    constructor(transition: GovernedActionTransition);
+    /** Structurally valid transition whose canonical command binding was recomputed successfully. */
+    get transition(): GovernedActionTransition;
+}
+/** Nominal server-only proof that a transition command digest was verified. */
+export type VerifiedGovernedActionTransition = VerifiedTransition;
+declare class VerifiedPolicyEvaluation {
+    #private;
+    constructor(evaluation: GovernedActionPolicyEvaluation, digest: GovernedActionPolicyEvaluationDigest);
+    /** Structurally valid policy evaluation whose complete canonical digest was verified. */
+    get evaluation(): GovernedActionPolicyEvaluation;
+    /** Recomputed canonical digest that matched the persisted policy-evaluation digest. */
+    get digest(): GovernedActionPolicyEvaluationDigest;
+}
+/** Nominal server-only proof that a complete policy-evaluation digest was verified. */
+export type VerifiedGovernedActionPolicyEvaluation = VerifiedPolicyEvaluation;
+declare class VerifiedAuthorization {
+    #private;
+    constructor(authorization: GovernedActionAuthorization, digest: GovernedActionAuthorizationDigest);
+    /** Structurally valid authorization whose complete canonical digest was verified. */
+    get authorization(): GovernedActionAuthorization;
+    /** Recomputed canonical digest that matched the persisted authorization digest. */
+    get digest(): GovernedActionAuthorizationDigest;
+}
+/** Nominal server-only proof that a complete authorization digest was verified. */
+export type VerifiedGovernedActionAuthorization = VerifiedAuthorization;
+declare class VerifiedAttempt {
+    #private;
+    constructor(attempt: GovernedActionAttempt, digest: GovernedActionAttemptDigest);
+    /** Structurally valid dispatch attempt whose complete canonical digest was verified. */
+    get attempt(): GovernedActionAttempt;
+    /** Recomputed canonical digest that matched the persisted attempt digest. */
+    get digest(): GovernedActionAttemptDigest;
+}
+/** Nominal server-only proof that a complete dispatch-attempt digest was verified. */
+export type VerifiedGovernedActionAttempt = VerifiedAttempt;
+declare class VerifiedTransitionRecord {
+    #private;
+    constructor(transition: GovernedActionTransition, digest: GovernedActionTransitionDigest);
+    /** Structurally valid transition whose command and complete canonical digest were verified. */
+    get transition(): GovernedActionTransition;
+    /** Recomputed canonical digest that matched the persisted transition digest. */
+    get digest(): GovernedActionTransitionDigest;
+}
+/** Nominal server-only proof that a complete transition record and its command were verified. */
+export type VerifiedGovernedActionTransitionRecord = VerifiedTransitionRecord;
+/** Canonical JSON text with recursively sorted object keys and order-preserving arrays. */
+export declare const canonicalizeGovernedActionJson: (value: Schema.Json) => string;
+/** Hash canonical JSON with the governed-action SHA-256 representation. */
+export declare const digestCanonicalGovernedActionJson: (value: Schema.Json) => Effect.Effect<string, GovernedActionDigestError, Crypto.Crypto>;
+/** Canonical immutable representation of one immediate provider outcome. */
+export interface EncodedGovernedActionDispatchOutcome {
+    readonly outcomeDigest: string;
+    readonly outcomeJson: string;
+}
+/** Encode and hash the exact versioned provider result retained by the durable execution inbox. */
+export declare const encodeGovernedActionDispatchOutcome: (result: Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"confirmed">;
+    readonly receipt: Schema.Union<readonly [Schema.Struct<{
+        readonly status: Schema.Literal<"accepted">;
+        readonly reconciliationKey: Schema.brand<Schema.String, string>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>, Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>]>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"unknown">;
+    readonly reconciliationKey: Schema.brand<Schema.String, string>;
+    readonly safeSummary: Schema.String;
+    readonly observedAt: Schema.DateTimeUtcFromString;
+}, "Type">) => Effect.Effect<EncodedGovernedActionDispatchOutcome, GovernedActionDigestError, Crypto.Crypto>;
+/** Encode and hash one locally observed unknown result retained by the dispatch inbox. */
+export declare const encodeGovernedActionUnknownOutcome: (outcome: Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"reconcilable">;
+    readonly reconciliationKey: Schema.brand<Schema.String, string>;
+    readonly observedAt: Schema.DateTimeUtcFromString;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"manual">;
+    readonly observedAt: Schema.DateTimeUtcFromString;
+    readonly safeSummary: Schema.String;
+    readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+}, "Type">) => Effect.Effect<EncodedGovernedActionDispatchOutcome, GovernedActionDigestError, Crypto.Crypto>;
+/** Hash one bounded provider payload independently of object insertion order. */
+export declare const digestGovernedActionPayload: (payload: Schema.Json) => Effect.Effect<string & import("effect/Brand").Brand<"PluginActionPayloadDigest">, GovernedActionDigestError, Crypto.Crypto>;
+/** Hash one closed transition command for exact caller-command replay checks. */
+export declare const digestGovernedActionTransitionCommand: (command: Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"propose">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"authorize">;
+    readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"deny">;
+    readonly reason: Schema.Literals<readonly ["revision-changed", "evidence-stale", "evidence-invalid", "policy-denied", "session-invalid", "capability-changed", "plugin-unavailable", "preflight-blocked"]>;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"expire">;
+    readonly reason: Schema.Literals<readonly ["proposal-expired", "authorization-expired"]>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"cancel">;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"start">;
+    readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"requestCancellation">;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordAccepted">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literal<"accepted">;
+        readonly reconciliationKey: Schema.brand<Schema.String, string>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordSucceeded">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordFailed">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordUnknown">;
+    readonly outcome: Schema.TaggedUnion<{
+        readonly reconcilable: Schema.TaggedStruct<"reconcilable", {
+            readonly reconciliationKey: Schema.brand<Schema.String, string>;
+            readonly observedAt: Schema.DateTimeUtcFromString;
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly manual: Schema.TaggedStruct<"manual", {
+            readonly observedAt: Schema.DateTimeUtcFromString;
+            readonly safeSummary: Schema.String;
+            readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordCancelled">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"reconciliationPending">;
+    readonly checkedAt: Schema.DateTimeUtcFromString;
+    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+}, "Type">) => Effect.Effect<string & import("effect/Brand").Brand<"GovernedActionCommandDigest">, GovernedActionDigestError, Crypto.Crypto>;
+/** Reject a retried command whose canonical content changed under the same identity. */
+export declare const verifyGovernedActionTransitionCommandDigest: (command: Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"propose">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"authorize">;
+    readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"deny">;
+    readonly reason: Schema.Literals<readonly ["revision-changed", "evidence-stale", "evidence-invalid", "policy-denied", "session-invalid", "capability-changed", "plugin-unavailable", "preflight-blocked"]>;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"expire">;
+    readonly reason: Schema.Literals<readonly ["proposal-expired", "authorization-expired"]>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"cancel">;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"start">;
+    readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"requestCancellation">;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordAccepted">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literal<"accepted">;
+        readonly reconciliationKey: Schema.brand<Schema.String, string>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordSucceeded">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordFailed">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordUnknown">;
+    readonly outcome: Schema.TaggedUnion<{
+        readonly reconcilable: Schema.TaggedStruct<"reconcilable", {
+            readonly reconciliationKey: Schema.brand<Schema.String, string>;
+            readonly observedAt: Schema.DateTimeUtcFromString;
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly manual: Schema.TaggedStruct<"manual", {
+            readonly observedAt: Schema.DateTimeUtcFromString;
+            readonly safeSummary: Schema.String;
+            readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordCancelled">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"reconciliationPending">;
+    readonly checkedAt: Schema.DateTimeUtcFromString;
+    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+}, "Type">, expectedDigest: string & import("effect/Brand").Brand<"GovernedActionCommandDigest">) => Effect.Effect<Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"propose">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"authorize">;
+    readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"deny">;
+    readonly reason: Schema.Literals<readonly ["revision-changed", "evidence-stale", "evidence-invalid", "policy-denied", "session-invalid", "capability-changed", "plugin-unavailable", "preflight-blocked"]>;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"expire">;
+    readonly reason: Schema.Literals<readonly ["proposal-expired", "authorization-expired"]>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"cancel">;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"start">;
+    readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"requestCancellation">;
+    readonly safeSummary: Schema.String;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordAccepted">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literal<"accepted">;
+        readonly reconciliationKey: Schema.brand<Schema.String, string>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordSucceeded">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordFailed">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordUnknown">;
+    readonly outcome: Schema.TaggedUnion<{
+        readonly reconcilable: Schema.TaggedStruct<"reconcilable", {
+            readonly reconciliationKey: Schema.brand<Schema.String, string>;
+            readonly observedAt: Schema.DateTimeUtcFromString;
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly manual: Schema.TaggedStruct<"manual", {
+            readonly observedAt: Schema.DateTimeUtcFromString;
+            readonly safeSummary: Schema.String;
+            readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"recordCancelled">;
+    readonly receipt: Schema.Struct<{
+        readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+        readonly providerOperationId: Schema.brand<Schema.String, string>;
+        readonly safeSummary: Schema.String;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly source: Schema.TaggedUnion<{
+        readonly direct: Schema.TaggedStruct<"direct", {}>;
+        readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+            readonly providerOperationId: Schema.brand<Schema.String, string>;
+        }>;
+        readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+}, "Type"> | Schema.Struct.ReadonlySide<{
+    readonly _tag: Schema.tag<"reconciliationPending">;
+    readonly checkedAt: Schema.DateTimeUtcFromString;
+    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+}, "Type">, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+/** Construct an append-only transition with a digest of its exact canonical command. */
+export declare const makeGovernedActionTransition: (material: Schema.Struct.ReadonlySide<{
+    schemaVersion: Schema.Literal<1>;
+    transitionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">;
+    previousTransitionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">>;
+    commandId: Schema.brand<Schema.String, string>;
+    actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    sequence: Schema.Int;
+    fromState: Schema.NullOr<Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>>;
+    toState: Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>;
+    actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    command: Schema.TaggedUnion<{
+        readonly propose: Schema.TaggedStruct<"propose", {}>;
+        readonly authorize: Schema.TaggedStruct<"authorize", {
+            readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+        }>;
+        readonly deny: Schema.TaggedStruct<"deny", {
+            readonly reason: Schema.Literals<readonly ["revision-changed", "evidence-stale", "evidence-invalid", "policy-denied", "session-invalid", "capability-changed", "plugin-unavailable", "preflight-blocked"]>;
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly expire: Schema.TaggedStruct<"expire", {
+            readonly reason: Schema.Literals<readonly ["proposal-expired", "authorization-expired"]>;
+        }>;
+        readonly cancel: Schema.TaggedStruct<"cancel", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly start: Schema.TaggedStruct<"start", {
+            readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+        }>;
+        readonly requestCancellation: Schema.TaggedStruct<"requestCancellation", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly recordAccepted: Schema.TaggedStruct<"recordAccepted", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literal<"accepted">;
+                readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+        }>;
+        readonly recordSucceeded: Schema.TaggedStruct<"recordSucceeded", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordFailed: Schema.TaggedStruct<"recordFailed", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordUnknown: Schema.TaggedStruct<"recordUnknown", {
+            readonly outcome: Schema.TaggedUnion<{
+                readonly reconcilable: Schema.TaggedStruct<"reconcilable", {
+                    readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                }>;
+                readonly manual: Schema.TaggedStruct<"manual", {
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                    readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+                }>;
+            }>;
+        }>;
+        readonly recordCancelled: Schema.TaggedStruct<"recordCancelled", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly reconciliationPending: Schema.TaggedStruct<"reconciliationPending", {
+            readonly checkedAt: Schema.DateTimeUtcFromString;
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+    cause: Schema.TaggedUnion<{
+        readonly human: Schema.TaggedStruct<"human", {
+            readonly actor: Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>;
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        }>;
+        readonly agent: Schema.TaggedStruct<"agent", {
+            readonly actor: Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>;
+            readonly jobId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "JobId">;
+        }>;
+        readonly system: Schema.TaggedStruct<"system", {
+            readonly component: Schema.brand<Schema.String, string>;
+        }>;
+    }>;
+    occurredAt: Schema.DateTimeUtcFromString;
+    causationId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "DomainEventId">>;
+    correlationId: Schema.NullOr<Schema.brand<Schema.String, "DomainEventCorrelationId">>;
+}, "Type">) => Effect.Effect<VerifiedTransition, GovernedActionDigestError, Crypto.Crypto>;
+/** Reject a decoded transition when its persisted command digest is stale or forged. */
+export declare const verifyGovernedActionTransition: (transition: Schema.Struct.ReadonlySide<{
+    readonly commandDigest: Schema.brand<Schema.String, "GovernedActionCommandDigest">;
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly transitionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">;
+    readonly previousTransitionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">>;
+    readonly commandId: Schema.brand<Schema.String, string>;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly sequence: Schema.Int;
+    readonly fromState: Schema.NullOr<Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>>;
+    readonly toState: Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>;
+    readonly actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    readonly command: Schema.TaggedUnion<{
+        readonly propose: Schema.TaggedStruct<"propose", {}>;
+        readonly authorize: Schema.TaggedStruct<"authorize", {
+            readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+        }>;
+        readonly deny: Schema.TaggedStruct<"deny", {
+            readonly reason: Schema.Literals<readonly ["revision-changed", "evidence-stale", "evidence-invalid", "policy-denied", "session-invalid", "capability-changed", "plugin-unavailable", "preflight-blocked"]>;
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly expire: Schema.TaggedStruct<"expire", {
+            readonly reason: Schema.Literals<readonly ["proposal-expired", "authorization-expired"]>;
+        }>;
+        readonly cancel: Schema.TaggedStruct<"cancel", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly start: Schema.TaggedStruct<"start", {
+            readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+        }>;
+        readonly requestCancellation: Schema.TaggedStruct<"requestCancellation", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly recordAccepted: Schema.TaggedStruct<"recordAccepted", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literal<"accepted">;
+                readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+        }>;
+        readonly recordSucceeded: Schema.TaggedStruct<"recordSucceeded", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordFailed: Schema.TaggedStruct<"recordFailed", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordUnknown: Schema.TaggedStruct<"recordUnknown", {
+            readonly outcome: Schema.TaggedUnion<{
+                readonly reconcilable: Schema.TaggedStruct<"reconcilable", {
+                    readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                }>;
+                readonly manual: Schema.TaggedStruct<"manual", {
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                    readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+                }>;
+            }>;
+        }>;
+        readonly recordCancelled: Schema.TaggedStruct<"recordCancelled", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly reconciliationPending: Schema.TaggedStruct<"reconciliationPending", {
+            readonly checkedAt: Schema.DateTimeUtcFromString;
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+    readonly cause: Schema.TaggedUnion<{
+        readonly human: Schema.TaggedStruct<"human", {
+            readonly actor: Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>;
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        }>;
+        readonly agent: Schema.TaggedStruct<"agent", {
+            readonly actor: Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>;
+            readonly jobId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "JobId">;
+        }>;
+        readonly system: Schema.TaggedStruct<"system", {
+            readonly component: Schema.brand<Schema.String, string>;
+        }>;
+    }>;
+    readonly occurredAt: Schema.DateTimeUtcFromString;
+    readonly causationId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "DomainEventId">>;
+    readonly correlationId: Schema.NullOr<Schema.brand<Schema.String, "DomainEventCorrelationId">>;
+}, "Type">) => Effect.Effect<VerifiedTransition, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+/** Hash the exact canonical evidence set bound to policy and authorization. */
+export declare const digestGovernedActionEvidenceSet: (evidence: readonly Schema.Struct.ReadonlySide<{
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly evidenceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceId">;
+    readonly evidenceClaimIds: Schema.$Array<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceClaimId">>;
+    readonly observedAt: Schema.DateTimeUtcFromString;
+    readonly validUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly currentUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly evaluatedAt: Schema.DateTimeUtcFromString;
+    readonly source: Schema.Literals<readonly ["current", "stale", "missing", "unavailable"]>;
+    readonly validity: Schema.Literals<readonly ["valid", "expired"]>;
+}, "Type">[]) => Effect.Effect<string & import("effect/Brand").Brand<string>, GovernedActionDigestError, Crypto.Crypto>;
+/** Hash one canonical declarative policy definition independently of object insertion order. */
+export declare const digestGovernedActionPolicyDefinition: (definition: Schema.Json) => Effect.Effect<string & import("effect/Brand").Brand<string>, GovernedActionDigestError, Crypto.Crypto>;
+/** Hash a fresh policy decision so the exact evaluation can be retained with dispatch intent. */
+export declare const digestGovernedActionPolicyEvaluation: (evaluation: Schema.Struct.ReadonlySide<{
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly policy: Schema.Struct<{
+        readonly policyId: Schema.brand<Schema.String, string>;
+        readonly policyVersion: Schema.Int;
+        readonly policyDigest: Schema.brand<Schema.String, string>;
+        readonly requiredPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    }>;
+    readonly payloadDigest: Schema.brand<Schema.String, "PluginActionPayloadDigest">;
+    readonly evidenceSetDigest: Schema.brand<Schema.String, string>;
+    readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+    readonly decision: Schema.Literals<readonly ["allowed", "denied"]>;
+    readonly evaluatedAt: Schema.DateTimeUtcFromString;
+}, "Type">) => Effect.Effect<string & import("effect/Brand").Brand<string>, GovernedActionDigestError, Crypto.Crypto>;
+/** Hash the complete immutable human authorization retained by the ledger. */
+export declare const digestGovernedActionAuthorization: (authorization: Schema.Struct.ReadonlySide<{
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    readonly pluginConnectionRevision: Schema.brand<Schema.Int, "GovernedActionPluginConnectionRevision">;
+    readonly pluginConnectionAuthorityDigest: Schema.brand<Schema.String, string>;
+    readonly actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    readonly idempotencyKey: Schema.brand<Schema.String, "GovernedActionIdempotencyKey">;
+    readonly payloadDigest: Schema.brand<Schema.String, "PluginActionPayloadDigest">;
+    readonly evidenceSetDigest: Schema.brand<Schema.String, string>;
+    readonly policyDigest: Schema.brand<Schema.String, string>;
+    readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+    readonly capabilityVersion: Schema.Int;
+    readonly actor: Schema.TaggedStruct<"human", {
+        readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+    }>;
+    readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+    readonly sessionPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    readonly sessionExpiresAt: Schema.DateTimeUtcFromString;
+    readonly requiredPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    readonly authorizedAt: Schema.DateTimeUtcFromString;
+    readonly expiresAt: Schema.DateTimeUtcFromString;
+}, "Type">) => Effect.Effect<string & import("effect/Brand").Brand<string>, GovernedActionDigestError, Crypto.Crypto>;
+/** Hash the complete immutable durable dispatch intent retained by the ledger. */
+export declare const digestGovernedActionAttempt: (attempt: Schema.Struct.ReadonlySide<{
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+    readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    readonly idempotencyKey: Schema.brand<Schema.String, "GovernedActionIdempotencyKey">;
+    readonly attemptNumber: Schema.Literal<1>;
+    readonly actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+    readonly policyEvaluationDigest: Schema.brand<Schema.String, string>;
+    readonly preflight: Schema.TaggedStruct<"ready", {
+        readonly checkedRevision: Schema.brand<Schema.String, "Revision">;
+        readonly checkedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly startedAt: Schema.DateTimeUtcFromString;
+}, "Type">) => Effect.Effect<string & import("effect/Brand").Brand<string>, GovernedActionDigestError, Crypto.Crypto>;
+/** Hash a complete immutable transition for audit-event binding. */
+export declare const digestGovernedActionTransition: (transition: Schema.Struct.ReadonlySide<{
+    readonly commandDigest: Schema.brand<Schema.String, "GovernedActionCommandDigest">;
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly transitionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">;
+    readonly previousTransitionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">>;
+    readonly commandId: Schema.brand<Schema.String, string>;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly sequence: Schema.Int;
+    readonly fromState: Schema.NullOr<Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>>;
+    readonly toState: Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>;
+    readonly actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    readonly command: Schema.TaggedUnion<{
+        readonly propose: Schema.TaggedStruct<"propose", {}>;
+        readonly authorize: Schema.TaggedStruct<"authorize", {
+            readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+        }>;
+        readonly deny: Schema.TaggedStruct<"deny", {
+            readonly reason: Schema.Literals<readonly ["revision-changed", "evidence-stale", "evidence-invalid", "policy-denied", "session-invalid", "capability-changed", "plugin-unavailable", "preflight-blocked"]>;
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly expire: Schema.TaggedStruct<"expire", {
+            readonly reason: Schema.Literals<readonly ["proposal-expired", "authorization-expired"]>;
+        }>;
+        readonly cancel: Schema.TaggedStruct<"cancel", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly start: Schema.TaggedStruct<"start", {
+            readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+        }>;
+        readonly requestCancellation: Schema.TaggedStruct<"requestCancellation", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly recordAccepted: Schema.TaggedStruct<"recordAccepted", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literal<"accepted">;
+                readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+        }>;
+        readonly recordSucceeded: Schema.TaggedStruct<"recordSucceeded", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordFailed: Schema.TaggedStruct<"recordFailed", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordUnknown: Schema.TaggedStruct<"recordUnknown", {
+            readonly outcome: Schema.TaggedUnion<{
+                readonly reconcilable: Schema.TaggedStruct<"reconcilable", {
+                    readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                }>;
+                readonly manual: Schema.TaggedStruct<"manual", {
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                    readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+                }>;
+            }>;
+        }>;
+        readonly recordCancelled: Schema.TaggedStruct<"recordCancelled", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly reconciliationPending: Schema.TaggedStruct<"reconciliationPending", {
+            readonly checkedAt: Schema.DateTimeUtcFromString;
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+    readonly cause: Schema.TaggedUnion<{
+        readonly human: Schema.TaggedStruct<"human", {
+            readonly actor: Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>;
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        }>;
+        readonly agent: Schema.TaggedStruct<"agent", {
+            readonly actor: Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>;
+            readonly jobId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "JobId">;
+        }>;
+        readonly system: Schema.TaggedStruct<"system", {
+            readonly component: Schema.brand<Schema.String, string>;
+        }>;
+    }>;
+    readonly occurredAt: Schema.DateTimeUtcFromString;
+    readonly causationId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "DomainEventId">>;
+    readonly correlationId: Schema.NullOr<Schema.brand<Schema.String, "DomainEventCorrelationId">>;
+}, "Type">) => Effect.Effect<string & import("effect/Brand").Brand<"GovernedActionTransitionDigest">, GovernedActionDigestError, Crypto.Crypto>;
+/** Verify the persisted digest of a complete immutable policy evaluation. */
+export declare const verifyGovernedActionPolicyEvaluation: (evaluation: Schema.Struct.ReadonlySide<{
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly policy: Schema.Struct<{
+        readonly policyId: Schema.brand<Schema.String, string>;
+        readonly policyVersion: Schema.Int;
+        readonly policyDigest: Schema.brand<Schema.String, string>;
+        readonly requiredPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    }>;
+    readonly payloadDigest: Schema.brand<Schema.String, "PluginActionPayloadDigest">;
+    readonly evidenceSetDigest: Schema.brand<Schema.String, string>;
+    readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+    readonly decision: Schema.Literals<readonly ["allowed", "denied"]>;
+    readonly evaluatedAt: Schema.DateTimeUtcFromString;
+}, "Type">, expectedDigest: string & import("effect/Brand").Brand<string>) => Effect.Effect<VerifiedPolicyEvaluation, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+/** Verify the persisted digest of a complete immutable human authorization. */
+export declare const verifyGovernedActionAuthorization: (authorization: Schema.Struct.ReadonlySide<{
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    readonly pluginConnectionRevision: Schema.brand<Schema.Int, "GovernedActionPluginConnectionRevision">;
+    readonly pluginConnectionAuthorityDigest: Schema.brand<Schema.String, string>;
+    readonly actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    readonly idempotencyKey: Schema.brand<Schema.String, "GovernedActionIdempotencyKey">;
+    readonly payloadDigest: Schema.brand<Schema.String, "PluginActionPayloadDigest">;
+    readonly evidenceSetDigest: Schema.brand<Schema.String, string>;
+    readonly policyDigest: Schema.brand<Schema.String, string>;
+    readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+    readonly capabilityVersion: Schema.Int;
+    readonly actor: Schema.TaggedStruct<"human", {
+        readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+    }>;
+    readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+    readonly sessionPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    readonly sessionExpiresAt: Schema.DateTimeUtcFromString;
+    readonly requiredPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    readonly authorizedAt: Schema.DateTimeUtcFromString;
+    readonly expiresAt: Schema.DateTimeUtcFromString;
+}, "Type">, expectedDigest: string & import("effect/Brand").Brand<string>) => Effect.Effect<VerifiedAuthorization, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+/** Verify the persisted digest of a complete immutable dispatch attempt. */
+export declare const verifyGovernedActionAttempt: (attempt: Schema.Struct.ReadonlySide<{
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+    readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    readonly idempotencyKey: Schema.brand<Schema.String, "GovernedActionIdempotencyKey">;
+    readonly attemptNumber: Schema.Literal<1>;
+    readonly actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+    readonly policyEvaluationDigest: Schema.brand<Schema.String, string>;
+    readonly preflight: Schema.TaggedStruct<"ready", {
+        readonly checkedRevision: Schema.brand<Schema.String, "Revision">;
+        readonly checkedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly startedAt: Schema.DateTimeUtcFromString;
+}, "Type">, expectedDigest: string & import("effect/Brand").Brand<string>) => Effect.Effect<VerifiedAttempt, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+/** Verify both the embedded command digest and persisted digest of a complete transition. */
+export declare const verifyGovernedActionTransitionDigest: (transition: Schema.Struct.ReadonlySide<{
+    readonly commandDigest: Schema.brand<Schema.String, "GovernedActionCommandDigest">;
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly transitionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">;
+    readonly previousTransitionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionTransitionId">>;
+    readonly commandId: Schema.brand<Schema.String, string>;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly sequence: Schema.Int;
+    readonly fromState: Schema.NullOr<Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>>;
+    readonly toState: Schema.Literals<readonly ["proposed", "authorized", "denied", "expired", "cancelled", "started", "cancel-requested", "cancel-requested-unknown", "succeeded", "failed", "unknown"]>;
+    readonly actionEnvelopeDigest: Schema.brand<Schema.String, string>;
+    readonly command: Schema.TaggedUnion<{
+        readonly propose: Schema.TaggedStruct<"propose", {}>;
+        readonly authorize: Schema.TaggedStruct<"authorize", {
+            readonly authorizationId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAuthorizationId">;
+        }>;
+        readonly deny: Schema.TaggedStruct<"deny", {
+            readonly reason: Schema.Literals<readonly ["revision-changed", "evidence-stale", "evidence-invalid", "policy-denied", "session-invalid", "capability-changed", "plugin-unavailable", "preflight-blocked"]>;
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly expire: Schema.TaggedStruct<"expire", {
+            readonly reason: Schema.Literals<readonly ["proposal-expired", "authorization-expired"]>;
+        }>;
+        readonly cancel: Schema.TaggedStruct<"cancel", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly start: Schema.TaggedStruct<"start", {
+            readonly attemptId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionAttemptId">;
+        }>;
+        readonly requestCancellation: Schema.TaggedStruct<"requestCancellation", {
+            readonly safeSummary: Schema.String;
+        }>;
+        readonly recordAccepted: Schema.TaggedStruct<"recordAccepted", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literal<"accepted">;
+                readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+        }>;
+        readonly recordSucceeded: Schema.TaggedStruct<"recordSucceeded", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordFailed: Schema.TaggedStruct<"recordFailed", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly recordUnknown: Schema.TaggedStruct<"recordUnknown", {
+            readonly outcome: Schema.TaggedUnion<{
+                readonly reconcilable: Schema.TaggedStruct<"reconcilable", {
+                    readonly reconciliationKey: Schema.brand<Schema.String, string>;
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                }>;
+                readonly manual: Schema.TaggedStruct<"manual", {
+                    readonly observedAt: Schema.DateTimeUtcFromString;
+                    readonly safeSummary: Schema.String;
+                    readonly reason: Schema.Literals<readonly ["dispatch-deadline-exceeded", "interrupted-after-intent", "provider-defect-after-intent", "malformed-provider-result", "receipt-persistence-failed", "missing-reconciliation-locator"]>;
+                }>;
+            }>;
+        }>;
+        readonly recordCancelled: Schema.TaggedStruct<"recordCancelled", {
+            readonly receipt: Schema.Struct<{
+                readonly status: Schema.Literals<readonly ["succeeded", "failed", "cancelled"]>;
+                readonly providerOperationId: Schema.brand<Schema.String, string>;
+                readonly safeSummary: Schema.String;
+                readonly observedAt: Schema.DateTimeUtcFromString;
+            }>;
+            readonly source: Schema.TaggedUnion<{
+                readonly direct: Schema.TaggedStruct<"direct", {}>;
+                readonly providerOperation: Schema.TaggedStruct<"providerOperation", {
+                    readonly providerOperationId: Schema.brand<Schema.String, string>;
+                }>;
+                readonly reconciliation: Schema.TaggedStruct<"reconciliation", {
+                    readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+                }>;
+            }>;
+        }>;
+        readonly reconciliationPending: Schema.TaggedStruct<"reconciliationPending", {
+            readonly checkedAt: Schema.DateTimeUtcFromString;
+            readonly reconciliationKey: Schema.NullOr<Schema.brand<Schema.String, string>>;
+        }>;
+    }>;
+    readonly cause: Schema.TaggedUnion<{
+        readonly human: Schema.TaggedStruct<"human", {
+            readonly actor: Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>;
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        }>;
+        readonly agent: Schema.TaggedStruct<"agent", {
+            readonly actor: Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>;
+            readonly jobId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "JobId">;
+        }>;
+        readonly system: Schema.TaggedStruct<"system", {
+            readonly component: Schema.brand<Schema.String, string>;
+        }>;
+    }>;
+    readonly occurredAt: Schema.DateTimeUtcFromString;
+    readonly causationId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "DomainEventId">>;
+    readonly correlationId: Schema.NullOr<Schema.brand<Schema.String, "DomainEventCorrelationId">>;
+}, "Type">, expectedDigest: string & import("effect/Brand").Brand<"GovernedActionTransitionDigest">) => Effect.Effect<VerifiedTransitionRecord, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+/** Hash every digest-free field in a complete immutable V1 action envelope. */
+export declare const digestGovernedActionEnvelope: (material: Schema.Struct.ReadonlySide<{
+    schemaVersion: Schema.Literal<1>;
+    actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    idempotencyKey: Schema.brand<Schema.String, "GovernedActionIdempotencyKey">;
+    workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    pluginConnectionRevision: Schema.brand<Schema.Int, "GovernedActionPluginConnectionRevision">;
+    pluginConnectionAuthorityDigest: Schema.brand<Schema.String, string>;
+    pluginId: Schema.brand<Schema.String, string>;
+    pluginContractVersion: Schema.Struct<{
+        readonly major: Schema.Int;
+        readonly minor: Schema.Int;
+        readonly patch: Schema.Int;
+    }>;
+    pluginAdapterVersion: Schema.Struct<{
+        readonly major: Schema.Int;
+        readonly minor: Schema.Int;
+        readonly patch: Schema.Int;
+    }>;
+    providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+    capability: Schema.Struct<{
+        readonly capabilityId: Schema.Literal<"action.execute">;
+        readonly version: Schema.Int;
+    }>;
+    targetEntityId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EntityId">;
+    proposal: Schema.Struct<{
+        readonly proposalKey: Schema.brand<Schema.String, string>;
+        readonly capabilityVersion: Schema.Int;
+        readonly request: Schema.Struct<{
+            readonly actionKind: Schema.brand<Schema.String, string>;
+            readonly target: Schema.Struct<{
+                entityType: Schema.brand<Schema.String, string>;
+                vendorImmutableId: Schema.brand<Schema.String, "VendorImmutableId">;
+            }>;
+            readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+            readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+            readonly evidenceIds: Schema.$Array<Schema.brand<Schema.String, string>>;
+        }>;
+        readonly payloadDigest: Schema.brand<Schema.String, "PluginActionPayloadDigest">;
+        readonly summary: Schema.String;
+        readonly impact: Schema.Struct<{
+            readonly level: Schema.Literals<readonly ["low", "medium", "high", "critical"]>;
+            readonly summary: Schema.String;
+        }>;
+        readonly proposedAt: Schema.DateTimeUtcFromString;
+    }>;
+    evidence: Schema.$Array<Schema.Struct<{
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly evidenceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceId">;
+        readonly evidenceClaimIds: Schema.$Array<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceClaimId">>;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+        readonly validUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly currentUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly evaluatedAt: Schema.DateTimeUtcFromString;
+        readonly source: Schema.Literals<readonly ["current", "stale", "missing", "unavailable"]>;
+        readonly validity: Schema.Literals<readonly ["valid", "expired"]>;
+    }>>;
+    evidenceSetDigest: Schema.brand<Schema.String, string>;
+    policy: Schema.Struct<{
+        readonly policyId: Schema.brand<Schema.String, string>;
+        readonly policyVersion: Schema.Int;
+        readonly policyDigest: Schema.brand<Schema.String, string>;
+        readonly requiredPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    }>;
+    origin: Schema.TaggedUnion<{
+        readonly human: Schema.TaggedStruct<"human", {
+            readonly actor: Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>;
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        }>;
+        readonly agent: Schema.TaggedStruct<"agent", {
+            readonly actor: Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>;
+            readonly jobId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "JobId">;
+            readonly initiatingSessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        }>;
+    }>;
+    proposalExpiresAt: Schema.DateTimeUtcFromString;
+    causationId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "DomainEventId">>;
+    correlationId: Schema.NullOr<Schema.brand<Schema.String, "DomainEventCorrelationId">>;
+}, "Type">) => Effect.Effect<string & import("effect/Brand").Brand<string>, GovernedActionDigestError, Crypto.Crypto>;
+/** Construct an envelope only after its payload and evidence bindings verify exactly. */
+export declare const makeGovernedActionEnvelope: (material: Schema.Struct.ReadonlySide<{
+    schemaVersion: Schema.Literal<1>;
+    actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    idempotencyKey: Schema.brand<Schema.String, "GovernedActionIdempotencyKey">;
+    workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    pluginConnectionRevision: Schema.brand<Schema.Int, "GovernedActionPluginConnectionRevision">;
+    pluginConnectionAuthorityDigest: Schema.brand<Schema.String, string>;
+    pluginId: Schema.brand<Schema.String, string>;
+    pluginContractVersion: Schema.Struct<{
+        readonly major: Schema.Int;
+        readonly minor: Schema.Int;
+        readonly patch: Schema.Int;
+    }>;
+    pluginAdapterVersion: Schema.Struct<{
+        readonly major: Schema.Int;
+        readonly minor: Schema.Int;
+        readonly patch: Schema.Int;
+    }>;
+    providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+    capability: Schema.Struct<{
+        readonly capabilityId: Schema.Literal<"action.execute">;
+        readonly version: Schema.Int;
+    }>;
+    targetEntityId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EntityId">;
+    proposal: Schema.Struct<{
+        readonly proposalKey: Schema.brand<Schema.String, string>;
+        readonly capabilityVersion: Schema.Int;
+        readonly request: Schema.Struct<{
+            readonly actionKind: Schema.brand<Schema.String, string>;
+            readonly target: Schema.Struct<{
+                entityType: Schema.brand<Schema.String, string>;
+                vendorImmutableId: Schema.brand<Schema.String, "VendorImmutableId">;
+            }>;
+            readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+            readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+            readonly evidenceIds: Schema.$Array<Schema.brand<Schema.String, string>>;
+        }>;
+        readonly payloadDigest: Schema.brand<Schema.String, "PluginActionPayloadDigest">;
+        readonly summary: Schema.String;
+        readonly impact: Schema.Struct<{
+            readonly level: Schema.Literals<readonly ["low", "medium", "high", "critical"]>;
+            readonly summary: Schema.String;
+        }>;
+        readonly proposedAt: Schema.DateTimeUtcFromString;
+    }>;
+    evidence: Schema.$Array<Schema.Struct<{
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly evidenceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceId">;
+        readonly evidenceClaimIds: Schema.$Array<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceClaimId">>;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+        readonly validUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly currentUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly evaluatedAt: Schema.DateTimeUtcFromString;
+        readonly source: Schema.Literals<readonly ["current", "stale", "missing", "unavailable"]>;
+        readonly validity: Schema.Literals<readonly ["valid", "expired"]>;
+    }>>;
+    evidenceSetDigest: Schema.brand<Schema.String, string>;
+    policy: Schema.Struct<{
+        readonly policyId: Schema.brand<Schema.String, string>;
+        readonly policyVersion: Schema.Int;
+        readonly policyDigest: Schema.brand<Schema.String, string>;
+        readonly requiredPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    }>;
+    origin: Schema.TaggedUnion<{
+        readonly human: Schema.TaggedStruct<"human", {
+            readonly actor: Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>;
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        }>;
+        readonly agent: Schema.TaggedStruct<"agent", {
+            readonly actor: Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>;
+            readonly jobId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "JobId">;
+            readonly initiatingSessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        }>;
+    }>;
+    proposalExpiresAt: Schema.DateTimeUtcFromString;
+    causationId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "DomainEventId">>;
+    correlationId: Schema.NullOr<Schema.brand<Schema.String, "DomainEventCorrelationId">>;
+}, "Type">) => Effect.Effect<VerifiedEnvelope, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+/** Recompute every canonical binding before trusting a decoded persisted envelope. */
+export declare const verifyGovernedActionEnvelope: (envelope: Schema.Struct.ReadonlySide<{
+    readonly envelopeDigest: Schema.brand<Schema.String, string>;
+    readonly schemaVersion: Schema.Literal<1>;
+    readonly actionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "GovernedActionId">;
+    readonly idempotencyKey: Schema.brand<Schema.String, "GovernedActionIdempotencyKey">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly pluginConnectionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PluginConnectionId">;
+    readonly pluginConnectionRevision: Schema.brand<Schema.Int, "GovernedActionPluginConnectionRevision">;
+    readonly pluginConnectionAuthorityDigest: Schema.brand<Schema.String, string>;
+    readonly pluginId: Schema.brand<Schema.String, string>;
+    readonly pluginContractVersion: Schema.Struct<{
+        readonly major: Schema.Int;
+        readonly minor: Schema.Int;
+        readonly patch: Schema.Int;
+    }>;
+    readonly pluginAdapterVersion: Schema.Struct<{
+        readonly major: Schema.Int;
+        readonly minor: Schema.Int;
+        readonly patch: Schema.Int;
+    }>;
+    readonly providerId: Schema.Literals<readonly ["codecommit", "codepipeline", "jira", "confluence", "clockify"]>;
+    readonly capability: Schema.Struct<{
+        readonly capabilityId: Schema.Literal<"action.execute">;
+        readonly version: Schema.Int;
+    }>;
+    readonly targetEntityId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EntityId">;
+    readonly proposal: Schema.Struct<{
+        readonly proposalKey: Schema.brand<Schema.String, string>;
+        readonly capabilityVersion: Schema.Int;
+        readonly request: Schema.Struct<{
+            readonly actionKind: Schema.brand<Schema.String, string>;
+            readonly target: Schema.Struct<{
+                entityType: Schema.brand<Schema.String, string>;
+                vendorImmutableId: Schema.brand<Schema.String, "VendorImmutableId">;
+            }>;
+            readonly expectedRevision: Schema.brand<Schema.String, "Revision">;
+            readonly payload: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+            readonly evidenceIds: Schema.$Array<Schema.brand<Schema.String, string>>;
+        }>;
+        readonly payloadDigest: Schema.brand<Schema.String, "PluginActionPayloadDigest">;
+        readonly summary: Schema.String;
+        readonly impact: Schema.Struct<{
+            readonly level: Schema.Literals<readonly ["low", "medium", "high", "critical"]>;
+            readonly summary: Schema.String;
+        }>;
+        readonly proposedAt: Schema.DateTimeUtcFromString;
+    }>;
+    readonly evidence: Schema.$Array<Schema.Struct<{
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly evidenceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceId">;
+        readonly evidenceClaimIds: Schema.$Array<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "EvidenceClaimId">>;
+        readonly observedAt: Schema.DateTimeUtcFromString;
+        readonly validUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly currentUntil: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly evaluatedAt: Schema.DateTimeUtcFromString;
+        readonly source: Schema.Literals<readonly ["current", "stale", "missing", "unavailable"]>;
+        readonly validity: Schema.Literals<readonly ["valid", "expired"]>;
+    }>>;
+    readonly evidenceSetDigest: Schema.brand<Schema.String, string>;
+    readonly policy: Schema.Struct<{
+        readonly policyId: Schema.brand<Schema.String, string>;
+        readonly policyVersion: Schema.Int;
+        readonly policyDigest: Schema.brand<Schema.String, string>;
+        readonly requiredPermission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    }>;
+    readonly origin: Schema.TaggedUnion<{
+        readonly human: Schema.TaggedStruct<"human", {
+            readonly actor: Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>;
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        }>;
+        readonly agent: Schema.TaggedStruct<"agent", {
+            readonly actor: Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>;
+            readonly jobId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "JobId">;
+            readonly initiatingSessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        }>;
+    }>;
+    readonly proposalExpiresAt: Schema.DateTimeUtcFromString;
+    readonly causationId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "DomainEventId">>;
+    readonly correlationId: Schema.NullOr<Schema.brand<Schema.String, "DomainEventCorrelationId">>;
+}, "Type">) => Effect.Effect<VerifiedEnvelope, GovernedActionDigestError | GovernedActionBindingMismatch, Crypto.Crypto>;
+export {};
+//# sourceMappingURL=governedActionDigests.d.ts.map