@cleocode/runtime 2026.10.27 → 2026.11.1-canary.3

package/README.md

@@ -1,5 +1,7 @@
 # @cleocode/runtime
 
+> Part of [CLEO](https://github.com/kryptobaseddev/cleo#readme). Start with the root README; run `cleo <command> --help` for any command.
+
 Long-running process layer for CLEO. Provides the daemon services that
 let an agent stay resident on a host: message polling, SSE connection
 management, heartbeat reporting, and credential key rotation.

package/dist/.source-stamp.json

@@ -0,0 +1,4 @@
+{
+  "schema": 2,
+  "sourceHash": "4708e023c48285516a4d1b7dc1e86758a870d4fae539d0418d9bff3625c5ffc7"
+}

package/dist/gateway/index.d.ts

@@ -10,7 +10,7 @@ import { G as GatewayHandler } from '../gateway-handler-DCU6E0a2.js';
 export { D as Dispatcher, a as DispatcherConfig, c as createGatewayHandler } from '../gateway-handler-DCU6E0a2.js';
 export { OrchestratePlanResult } from '@cleocode/contracts/operations/orchestrate';
 import * as _cleocode_core_internal from '@cleocode/core/internal';
-export { ArchiveStatsResult as ArchiveStatsData, AuditResult as AuditData, BackupResult as BackupData, BackupEntry as BackupEntryData, CleanupResult as CleanupData, CompactTask, ComplianceData, ContextData, DashboardData, DecisionRecord, DiagnosticsResult as DiagnosticsData, FileRestoreResult, HealthResult as HealthData, HelpData, HookMatrixResult, InjectGenerateResult as InjectGenerateData, IssueTemplate, IvtrHistoryEntry, LabelsResult as LabelsData, LifecycleStageEntry, LogQueryData, SystemMetricsResult as MetricsData, MigrateResult as MigrateData, OrchestratePlanInput, PathsData, PlanWarning, PlanWave, PlanWorkerEntry, ProviderMatrixEntry, ManifestEntry as ResearchManifestEntry, RestoreResult as RestoreData, RuntimeDiagnostics as RuntimeData, SafestopResult as SafestopData, ScaffoldHubData, StatsData, SyncData, TemplateConfig, TemplateSection, UncancelResult as UncancelData, addTaskWithSessionScope, completeTaskStrict, configGet, configListPresets, configSet, configSetPreset, ensureInitialized, filterEntries as filterManifestEntries, getVersion, initProject, isAutoInitEnabled, lifecycleCheck, lifecycleGateFail, lifecycleGatePass, lifecycleGates, lifecycleHistory, lifecyclePrerequisites, lifecycleProgress, lifecycleReset, lifecycleSkip, lifecycleStatus, mapCodebase, memoryBrainStats, memoryContradictions, memoryDecisionFind, memoryDecisionStore, memoryFetch, memoryFind, memoryGraphAdd, memoryGraphContext, memoryGraphNeighbors, memoryGraphRelated, memoryGraphRemove, memoryGraphShow, memoryGraphStatsFull, memoryGraphTrace, memoryLearningFind, memoryLearningStats, memoryLearningStore, memoryLink, memoryObserve, memoryPatternFind, memoryPatternStats, memoryPatternStore, memoryQualityReport, memoryReasonSimilar, memoryReasonWhy, memorySearchHybrid, memoryShow, memorySuperseded, memoryTimeline, memoryUnlink, orchestrateAnalyze, orchestrateBootstrap, orchestrateCheck, orchestrateContext, orchestrateCriticalPath, orchestrateHandoff, orchestrateNext, orchestrateParallelEnd, orchestrateParallelStart, orchestratePlan, orchestrateReady, orchestrateReport, orchestrateSkillInject, orchestrateSpawn, orchestrateSpawnExecute, orchestrateStartup, orchestrateStatus, orchestrateUnblockOpportunities, orchestrateValidate, orchestrateWaves, phaseAdvance, phaseComplete, phaseDelete, phaseList, phaseRename, phaseSet, phaseShow, phaseStart, pipelineManifestAppend, pipelineManifestArchive, pipelineManifestFind, pipelineManifestList, pipelineManifestPending, pipelineManifestShow, pipelineManifestStats, queryCommonHooks, queryHookProviders, readManifestEntries, releaseCancel, releaseCommit, releaseGateCheck, releaseGatesRun, releaseIvtrAutoSuggest, releaseList, releaseOpen, releasePlan, releasePrStatus, releasePrepare, releasePush, releaseReconcileV2, releaseRollback, releaseRollbackFull, releaseShow, releaseTag, sessionAdopt, sessionArchive, sessionBriefing, sessionChainShow, sessionCleanup, sessionComputeDebrief, sessionComputeHandoff, sessionContextDrift, sessionContextInject, sessionDebriefShow, sessionDecisionLog, sessionEnd, sessionFind, sessionGc, sessionHandoff, sessionHistory, sessionList, sessionRecordAssumption, sessionRecordDecision, sessionResume, sessionShow, sessionStart, sessionStats, sessionStatus, sessionSuspend, sessionSwitch, systemHooksMatrix, taskAnalyze, taskArchive, taskAssignee, taskBatchValidate, taskBlockers, taskBulkMove, taskCancel, taskClaim, taskComplete, taskComplexityEstimate, taskCurrentGet, taskDecompose, taskDelete, taskDepends, taskDeps, taskDepsCycles, taskDepsOverview, taskDepsTree, taskDepsValidate, taskExists, taskExport, taskFind, taskHistory, taskImpact, taskImport, taskLabelList, taskLabelShow, taskLint, taskList, taskNext, taskPlan, taskPromote, taskRankingHistory, taskRankingRevert, taskReconcileScope, taskRelates, taskRelatesAdd, taskRelatesAddBatch, taskRelatesFind, taskRelatesRemove, taskReopen, taskReorder, taskReorderRank, taskReparent, taskRestore, taskShow, taskShowIvtrHistory, taskShowOperation, taskShowWithHistory, taskSlice, taskStart, taskStats, taskStop, taskSyncLinks, taskSyncLinksRemove, taskSyncReconcile, taskTree, taskUnarchive, taskUnclaim, taskUpdate, taskWorkHistory, tasksAddBatchOp, coreBatchValidate as validateBatchValidate, validateChangelog, coreCoherenceCheck as validateCoherenceCheck, coreComplianceRecord as validateComplianceRecord, coreComplianceSummary as validateComplianceSummary, coreComplianceViolations as validateComplianceViolations, validateGateVerify, coreValidateManifest as validateManifestOp, coreValidateOutput as validateOutput, coreValidateProtocol as validateProtocol, validateProtocolArchitectureDecision, validateProtocolArtifactPublish, validateProtocolConsensus, validateProtocolContribution, validateProtocolDecomposition, validateProtocolImplementation, validateProtocolProvenance, validateProtocolRelease, validateProtocolResearch, validateProtocolSpecification, validateProtocolTesting, validateProtocolValidation, coreValidateSchema as validateSchemaOp, coreValidateTask as validateTaskOp, coreTestCoverage as validateTestCoverage, coreTestRun as validateTestRun, coreTestStatus as validateTestStatus } from '@cleocode/core/internal';
+export { ArchiveStatsResult as ArchiveStatsData, AuditResult as AuditData, BackupResult as BackupData, BackupEntry as BackupEntryData, CleanupResult as CleanupData, CompactTask, ComplianceData, ContextData, DashboardData, DecisionRecord, DiagnosticsResult as DiagnosticsData, FileRestoreResult, HealthResult as HealthData, HelpData, HookMatrixResult, InjectGenerateResult as InjectGenerateData, IssueTemplate, IvtrHistoryEntry, LabelsResult as LabelsData, LifecycleStageEntry, LogQueryData, SystemMetricsResult as MetricsData, MigrateResult as MigrateData, OrchestratePlanInput, PathsData, PlanWarning, PlanWave, PlanWorkerEntry, ProviderMatrixEntry, ManifestEntry as ResearchManifestEntry, RestoreResult as RestoreData, RuntimeDiagnostics as RuntimeData, SafestopResult as SafestopData, ScaffoldHubData, StatsData, SyncData, TemplateConfig, TemplateSection, UncancelResult as UncancelData, addTaskWithSessionScope, completeTaskStrict, configGet, configListPresets, configSet, configSetPreset, ensureInitialized, filterEntries as filterManifestEntries, getVersion, initProject, isAutoInitEnabled, lifecycleCheck, lifecycleGateFail, lifecycleGatePass, lifecycleGates, lifecycleHistory, lifecyclePrerequisites, lifecycleProgress, lifecycleReset, lifecycleSkip, lifecycleStatus, mapCodebase, memoryBrainStats, memoryContradictions, memoryDecisionFind, memoryDecisionStore, memoryFetch, memoryFind, memoryGraphAdd, memoryGraphContext, memoryGraphNeighbors, memoryGraphRelated, memoryGraphRemove, memoryGraphShow, memoryGraphStatsFull, memoryGraphTrace, memoryLearningFind, memoryLearningStats, memoryLearningStore, memoryLink, memoryObserve, memoryPatternFind, memoryPatternStats, memoryPatternStore, memoryQualityReport, memoryReasonSimilar, memoryReasonWhy, memorySearchHybrid, memoryShow, memorySuperseded, memoryTimeline, memoryUnlink, orchestrateAnalyze, orchestrateBootstrap, orchestrateCheck, orchestrateContext, orchestrateCriticalPath, orchestrateHandoff, orchestrateNext, orchestrateParallelEnd, orchestrateParallelStart, orchestratePlan, orchestrateReady, orchestrateReport, orchestrateSkillInject, orchestrateSpawn, orchestrateSpawnExecute, orchestrateStartup, orchestrateStatus, orchestrateUnblockOpportunities, orchestrateValidate, orchestrateWaves, phaseAdvance, phaseComplete, phaseDelete, phaseList, phaseRename, phaseSet, phaseShow, phaseStart, pipelineManifestAppend, pipelineManifestArchive, pipelineManifestFind, pipelineManifestList, pipelineManifestPending, pipelineManifestShow, pipelineManifestStats, queryCommonHooks, queryHookProviders, readManifestEntries, releaseCancel, releaseChangelog, releaseCommit, releaseCut, releaseGateCheck, releaseGatesRun, releaseIvtrAutoSuggest, releaseList, releaseOpen, releasePlan, releasePrStatus, releasePrepare, releasePush, releaseReconcileV2, releaseRollback, releaseRollbackFull, releaseShow, releaseTag, releaseVerifyTag, sessionAdopt, sessionArchive, sessionBriefing, sessionChainShow, sessionCleanup, sessionComputeDebrief, sessionComputeHandoff, sessionContextDrift, sessionContextInject, sessionDebriefShow, sessionDecisionLog, sessionEnd, sessionFind, sessionGc, sessionHandoff, sessionHistory, sessionList, sessionRecordAssumption, sessionRecordDecision, sessionResume, sessionShow, sessionStart, sessionStats, sessionStatus, sessionSuspend, sessionSwitch, systemHooksMatrix, taskAnalyze, taskArchive, taskAssignee, taskBatchValidate, taskBlockers, taskBulkMove, taskCancel, taskClaim, taskComplete, taskComplexityEstimate, taskCurrentGet, taskDecompose, taskDelete, taskDepends, taskDeps, taskDepsCycles, taskDepsOverview, taskDepsTree, taskDepsValidate, taskExists, taskExport, taskFind, taskHistory, taskImpact, taskImport, taskLabelList, taskLabelShow, taskLint, taskList, taskNext, taskPlan, taskPromote, taskRankingHistory, taskRankingRevert, taskReconcileScope, taskRelates, taskRelatesAdd, taskRelatesAddBatch, taskRelatesFind, taskRelatesRemove, taskReopen, taskReorder, taskReorderRank, taskReparent, taskRestore, taskShow, taskShowIvtrHistory, taskShowOperation, taskShowWithHistory, taskSlice, taskStart, taskStats, taskStop, taskSyncLinks, taskSyncLinksRemove, taskSyncReconcile, taskTree, taskUnarchive, taskUnclaim, taskUpdate, taskWorkHistory, tasksAddBatchOp, coreBatchValidate as validateBatchValidate, validateChangelog, coreCoherenceCheck as validateCoherenceCheck, coreComplianceRecord as validateComplianceRecord, coreComplianceSummary as validateComplianceSummary, coreComplianceViolations as validateComplianceViolations, validateGateVerify, coreValidateManifest as validateManifestOp, coreValidateOutput as validateOutput, coreValidateProtocol as validateProtocol, validateProtocolArchitectureDecision, validateProtocolArtifactPublish, validateProtocolConsensus, validateProtocolContribution, validateProtocolDecomposition, validateProtocolImplementation, validateProtocolProvenance, validateProtocolRelease, validateProtocolResearch, validateProtocolSpecification, validateProtocolTesting, validateProtocolValidation, coreValidateSchema as validateSchemaOp, coreValidateTask as validateTaskOp, coreTestCoverage as validateTestCoverage, coreTestRun as validateTestRun, coreTestStatus as validateTestStatus } from '@cleocode/core/internal';
 import { EngineResult } from '@cleocode/core';
 export { EngineResult } from '@cleocode/core';
 export { B as BRAIN_DB_FILENAME, C as CLEO_DIR_NAME, E as ErrorMeta, O as OPERATIONS, S as STRING_TO_EXIT, a as StreamResolution, W as WORKFLOWS_SUBDIR, b as buildNexusMetaExtensions, c as cleoErrorToEngineError, d as compose, e as createDispatchMeta, f as deriveGatewayMatrix, g as engineError, h as formatSuggestedNext, i as getActiveDomains, j as getByDomain, k as getByGateway, l as getByTier, m as getCounts, n as getGatewayDomains, o as inferGateway, p as pickDecoratorMetaExtensions, r as resolve, q as resolveStreamRoute, s as stampNexusMeta, v as validateRequiredParams, t as validateSuggestedNext } from '../dispatch-DOd44kC3.js';

package/dist/gateway/index.js

@@ -268,7 +268,9 @@ import {
   queryHookProviders,
   readManifestEntries,
   releaseCancel,
+  releaseChangelog,
   releaseCommit,
+  releaseCut,
   releaseGateCheck,
   releaseGatesRun,
   releaseIvtrAutoSuggest,
@@ -283,6 +285,7 @@ import {
   releaseRollbackFull,
   releaseShow,
   releaseTag,
+  releaseVerifyTag,
   sessionAdopt,
   sessionArchive,
   sessionBriefing,
@@ -603,7 +606,9 @@ export {
   readManifestEntries,
   registerStreamSource,
   releaseCancel,
+  releaseChangelog,
   releaseCommit,
+  releaseCut,
   releaseGateCheck,
   releaseGatesRun,
   releaseIvtrAutoSuggest,
@@ -618,6 +623,7 @@ export {
   releaseRollbackFull,
   releaseShow,
   releaseTag,
+  releaseVerifyTag,
   resolve,
   resolveStreamRoute,
   resolveStreamSource,

package/dist/gateway/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/gateway/background-jobs.ts","../../src/gateway/daemon-subsystem.ts","../../src/gateway/engine.ts","../../src/gateway/template-parser.ts","../../src/gateway/job-manager-accessor.ts","../../src/gateway/serve.ts"],"sourcesContent":["/**\n * Background Job Manager — gateway re-export.\n *\n * @remarks\n * The Drizzle-backed background-job manager lives in `@cleocode/core/store`\n * (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) — that is the package which owns the\n * consolidated SQLite schema and the SINGLE `drizzle-orm` instance, so the query\n * builders type-check against one instance (no dual peer-hashed `SQL<unknown>`\n * mismatch under `tsc -b`). This module re-exports that surface so the gateway\n * (and the `@cleocode/runtime/gateway` barrel) expose `BackgroundJobManager` etc.\n * WITHOUT `@cleocode/runtime` taking its own `drizzle-orm` dependency.\n *\n * @task T641\n * @task T11455\n */\n\nexport {\n  type BackgroundJob,\n  BackgroundJobManager,\n  type BackgroundJobManagerConfig,\n  type BackgroundJobStatus,\n  DurableJobStore,\n} from '@cleocode/core/store/background-jobs.js';\n","/**\n * The gateway as a supervised **daemon subsystem**.\n *\n * R3-T7 (this task) closes the loop between the two R-track halves: the R3\n * gateway (dispatcher + the four transport adapters) and the R2 daemon\n * (`defineSubsystem` + the `SubsystemRegistry`). It expresses the\n * external-facing gateway as a uniform {@link Subsystem} so the R2 daemon\n * registry drives its `start → healthProbe → shutdown` lifecycle exactly like\n * every other long-running concern (Studio supervision, the GC cron, …). One\n * gateway subsystem is registered per scope (project / global) → one\n * external-facing gateway process per scope.\n *\n * Which transports the daemon hosts:\n *  - the **RPC unix socket** (`@cleocode/runtime/gateway/rpc`) — the canonical\n *    local-client wire: the `cleo` CLI, Studio's server process, and test\n *    harnesses open it to dispatch without paying a cold `cleo` spawn.\n *  - the **HTTP server** (`@cleocode/runtime/gateway/http` via the daemon-local\n *    `startHttpServer` embedder) — for external clients that speak HTTP rather\n *    than the unix-socket NDJSON wire.\n *\n * The CLI and MCP adapters are intentionally NOT hosted by the daemon: the CLI\n * adapter is in-process to the `cleo` binary, and the MCP adapter is a stdio\n * server an MCP client spawns and owns — neither is a long-lived,\n * daemon-supervised listener. The two external-facing listeners (RPC + HTTP)\n * are the ones the daemon owns.\n *\n * This subsystem adds NO behavior to the adapters themselves — it only wires\n * their existing `start*Server` / `close()` lifecycle (and their already-merged\n * routing) into the daemon registry's uniform lifecycle. It carries NO\n * `@cleocode/cleo` dependency and NO drizzle-orm (the runtime invariant): the\n * caller injects the assembled {@link GatewayHandler} and the resolved bind\n * coordinates; this module only orchestrates listeners.\n *\n * @packageDocumentation\n * @module @cleocode/runtime/gateway\n *\n * @task T11451 (R3-T7)\n * @epic T11254\n * @saga T11243 SG-RUNTIME-UNIFICATION\n */\n\nimport type { Subsystem, SubsystemHealth, SubsystemState } from '@cleocode/contracts';\nimport { getLogger } from '@cleocode/core';\nimport { defineSubsystem } from '../daemon/index.js';\nimport { type HttpServerHandle, type HttpServerOptions, startHttpServer } from './http/listen.js';\nimport type { GatewayHandler } from './index.js';\nimport { type RpcServerHandle, type RpcServerOptions, startRpcServer } from './rpc/index.js';\n\n/** The scope a single gateway process serves — one external-facing process per scope. */\nexport type GatewayScope = 'project' | 'global';\n\n/**\n * Configuration for one scoped gateway subsystem.\n *\n * The caller injects the assembled, transport-neutral {@link GatewayHandler}\n * (built with `createGatewayHandler` from its domain handlers + middleware) and\n * the resolved bind coordinates for each hosted transport. The runtime never\n * resolves paths/ports itself — that keeps it free of `@cleocode/paths` and of\n * any policy decision about where a scope's socket/port lives.\n */\nexport interface GatewaySubsystemOptions {\n  /** The scope this gateway process serves (`project` | `global`). */\n  scope: GatewayScope;\n  /** The transport-neutral gateway handler every hosted transport routes through. */\n  handler: GatewayHandler;\n  /**\n   * RPC unix-socket transport options. When omitted, the RPC transport is not\n   * hosted (a deployment that only wants HTTP). At least one transport MUST be\n   * configured.\n   */\n  rpc?: RpcServerOptions;\n  /**\n   * HTTP transport options. When omitted, the HTTP transport is not hosted (a\n   * deployment that only wants the local RPC socket). At least one transport\n   * MUST be configured.\n   */\n  http?: HttpServerOptions;\n}\n\n/**\n * The live context a started gateway subsystem threads from `start` into\n * `healthProbe`/`shutdown`: the bound transport handles plus the owning pid.\n *\n * `void`-typed contexts are common for subsystems, but the gateway needs to\n * carry its bound handles so `shutdown` can close exactly what `start` opened\n * (and `healthProbe` can report the bound coordinates).\n */\nexport interface GatewaySubsystemContext {\n  /** The OS pid hosting the listeners (this daemon process). */\n  readonly pid: number;\n  /** The bound RPC server handle, when the RPC transport is hosted. */\n  readonly rpc?: RpcServerHandle;\n  /** The bound HTTP server handle, when the HTTP transport is hosted. */\n  readonly http?: HttpServerHandle;\n}\n\n/**\n * The stable subsystem name (and supervised `child_id`) of a scoped gateway.\n *\n * Suffixed with the scope so a single daemon process supervising both scopes\n * (project + global) registers two distinct, non-colliding subsystems. The\n * `child_id` matches the id the Rust supervisor tracks the listener under.\n *\n * @param scope - The gateway scope.\n * @returns The subsystem name, e.g. `gateway-project`.\n */\nexport function gatewaySubsystemName(scope: GatewayScope): string {\n  return `gateway-${scope}`;\n}\n\n/**\n * Declare the external-facing gateway as a supervised daemon {@link Subsystem}.\n *\n * The returned subsystem (frozen by {@link defineSubsystem}) is registered with\n * a `SubsystemRegistry`, which then drives its lifecycle uniformly:\n *\n *  - `start()`       — binds the configured transports (RPC unix socket and/or\n *    HTTP server) over the injected handler, in a fixed order (RPC then HTTP).\n *    If the second listener fails to bind, the first is rolled back so a failed\n *    start leaves no half-open listener — then the error is re-thrown for the\n *    registry's `onError` sink.\n *  - `healthProbe()` — reports a single {@link SubsystemHealth} row keyed on the\n *    scoped `child_id`, `running` while the configured listeners are live, with\n *    a `detail` summarizing the bound coordinates. Projects losslessly onto the\n *    supervisor's `ChildStatus`.\n *  - `shutdown()`    — closes every bound listener (best-effort, idempotent) in\n *    reverse bind order (HTTP then RPC).\n *\n * One subsystem instance is declared per scope, so registering the project and\n * global gateways yields two supervised listeners → one external-facing gateway\n * process surface per scope (AC1).\n *\n * @param opts - The scoped gateway configuration (handler + per-transport bind\n *   coordinates).\n * @returns A frozen {@link Subsystem} ready to `register()` with a\n *   `SubsystemRegistry`.\n * @throws {TypeError} When neither the RPC nor the HTTP transport is configured\n *   (a gateway with no hosted transport serves nothing).\n *\n * @example\n * ```ts\n * const registry = new SubsystemRegistry();\n * registry.register(\n *   defineGatewaySubsystem({\n *     scope: 'project',\n *     handler: createGatewayHandler(dispatcherConfig),\n *     rpc: { socketPath: '/run/cleo/cleo-gateway-rpc-project.sock' },\n *     http: { port: 7777 },\n *   }),\n * );\n * await registry.startAll();        // binds the RPC socket + HTTP server\n * const health = await registry.aggregateHealth();\n * await registry.shutdownAll();     // closes both listeners\n * ```\n */\nexport function defineGatewaySubsystem(\n  opts: GatewaySubsystemOptions,\n): Subsystem<GatewaySubsystemContext> {\n  if (opts.rpc === undefined && opts.http === undefined) {\n    throw new TypeError(\n      'defineGatewaySubsystem: at least one transport (rpc and/or http) must be configured',\n    );\n  }\n\n  const name = gatewaySubsystemName(opts.scope);\n  const log = getLogger(name);\n\n  // The `Subsystem.healthProbe` contract takes NO arguments — the registry only\n  // threads the start→shutdown context, not into the probe. We therefore hold\n  // the live context in a closure so `healthProbe()` can read the bound handles\n  // (and report `stopped` before `start()`/after `shutdown()`).\n  let live: GatewaySubsystemContext | undefined;\n\n  return defineSubsystem<GatewaySubsystemContext>({\n    name,\n\n    async start(): Promise<GatewaySubsystemContext> {\n      // Bind RPC first, then HTTP, so the unix socket is available before the\n      // HTTP listener (the canonical local wire comes up first). On an HTTP\n      // bind failure, roll back the RPC socket so start() never leaves a\n      // half-open listener for the registry's onError to clean up after.\n      let rpc: RpcServerHandle | undefined;\n      try {\n        if (opts.rpc !== undefined) {\n          rpc = await startRpcServer(opts.handler, opts.rpc);\n        }\n        let http: HttpServerHandle | undefined;\n        if (opts.http !== undefined) {\n          http = await startHttpServer(opts.handler, opts.http);\n        }\n        const context: GatewaySubsystemContext = { pid: process.pid, rpc, http };\n        live = context;\n        log.info(\n          { scope: opts.scope, rpc: rpc?.socketPath, httpPort: http?.port },\n          'gateway subsystem started',\n        );\n        return context;\n      } catch (cause) {\n        // Roll back any listener already bound before re-throwing.\n        if (rpc !== undefined) {\n          await rpc.close().catch(() => undefined);\n        }\n        live = undefined;\n        throw cause;\n      }\n    },\n\n    healthProbe(): SubsystemHealth {\n      // Not started (or already shut down) → report a stopped row so the\n      // aggregate `allHealthy` cannot be falsely true.\n      if (live === undefined) {\n        const stopped: SubsystemState = 'stopped';\n        return {\n          child_id: name,\n          pid: 0,\n          state: stopped,\n          restart_count: 0,\n          detail: `scope=${opts.scope} not started`,\n        };\n      }\n      const transports: string[] = [];\n      if (live.rpc !== undefined) transports.push(`rpc=${live.rpc.socketPath}`);\n      if (live.http !== undefined) {\n        transports.push(`http=${live.http.host}:${live.http.port}`);\n      }\n      const running: SubsystemState = 'running';\n      return {\n        child_id: name,\n        pid: live.pid,\n        state: running,\n        restart_count: 0,\n        detail: `scope=${opts.scope} ${transports.join(' ')}`.trim(),\n      };\n    },\n\n    async shutdown(context: GatewaySubsystemContext): Promise<void> {\n      // Reverse bind order: close HTTP before the RPC socket. Both close()\n      // calls are idempotent and best-effort — one failure must not block the\n      // other listener's teardown.\n      if (context.http !== undefined) {\n        await context.http.close().catch((err: unknown) => {\n          log.warn({ err }, 'gateway http close failed');\n        });\n      }\n      if (context.rpc !== undefined) {\n        await context.rpc.close().catch((err: unknown) => {\n          log.warn({ err }, 'gateway rpc close failed');\n        });\n      }\n      live = undefined;\n      log.info({ scope: opts.scope }, 'gateway subsystem stopped');\n    },\n  });\n}\n","/**\n * Engine Re-exports for Gateway Domain Handlers\n *\n * Centralizes the engine imports consumed by the domain handlers into a single\n * barrel. Every symbol re-exported here ultimately resolves to\n * `@cleocode/core/internal` (the canonical business-logic SSoT) or core's\n * template parser — this file adds NO logic of its own.\n *\n * @remarks\n * Relocated from `packages/cleo/src/dispatch/lib/engine.ts` into\n * `@cleocode/runtime/gateway` (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) so the\n * runtime can assemble the handler map without importing `@cleocode/cleo`.\n * Mirrors the `meta` / `registry` / `dispatcher` relocations (R3-T3 · T11447).\n * A thin re-export shim remains at the old `lib/engine.ts` path so the\n * in-package import sites compile unchanged (zero behavior change).\n *\n * @epic T4820\n * @task T4815\n * @task T11455\n */\n\nexport type { MinimalTaskRecord, Session as SessionRecord, TaskRecord } from '@cleocode/contracts';\nexport type { OrchestratePlanResult } from '@cleocode/contracts/operations/orchestrate';\n// Task operations — re-exported from @cleocode/core/internal (T1568 / ADR-057 / ADR-058)\n// task-engine.ts was deleted in Wave 5; all symbols now live in core/tasks/.\n// Orchestrate — types and functions from @cleocode/core/internal (T1570 ADR-057)\n// System — type aliases for backward compat (T1571: system-engine.ts deleted, canonical sources = @cleocode/core/internal)\nexport type {\n  ArchiveStatsResult as ArchiveStatsData,\n  AuditResult as AuditData,\n  BackupEntry as BackupEntryData,\n  BackupResult as BackupData,\n  CleanupResult as CleanupData,\n  CompactTask,\n  ComplianceData,\n  ContextData,\n  DashboardData,\n  DiagnosticsResult as DiagnosticsData,\n  FileRestoreResult,\n  HealthResult as HealthData,\n  HelpData,\n  InjectGenerateResult as InjectGenerateData,\n  IvtrHistoryEntry,\n  LabelsResult as LabelsData,\n  LifecycleStageEntry,\n  LogQueryData,\n  MigrateResult as MigrateData,\n  OrchestratePlanInput,\n  PathsData,\n  PlanWarning,\n  PlanWave,\n  PlanWorkerEntry,\n  RestoreResult as RestoreData,\n  RuntimeDiagnostics as RuntimeData,\n  SafestopResult as SafestopData,\n  ScaffoldHubData,\n  StatsData,\n  SyncData,\n  SystemMetricsResult as MetricsData,\n  UncancelResult as UncancelData,\n} from '@cleocode/core/internal';\n// Pipeline manifest functions (moved from memory domain in T5241)\n// Release engine (T1572 — ENG-MIG-5: migrated to @cleocode/core/internal)\n// Session engine (T1573 — ENG-MIG-6: migrated to @cleocode/core/internal)\n// Lifecycle engine ops — re-exported from @cleocode/core/internal (T1576 / ENG-MIG-9 / ADR-057)\n// lifecycle-engine.ts shrunk to a shim; all symbols now live in core/lifecycle/engine-ops.ts.\n// Hooks engine (ENG-MIG-12 / T1579 — logic in @cleocode/core/internal)\n// Init engine-ops — migrated to @cleocode/core/internal (ENG-MIG-14 / T1581 / ADR-057)\n// Config engine-ops — migrated to @cleocode/core/internal (ENG-MIG-15 / T1582 / ADR-057)\n// config-engine.ts shrunk to a shim; all symbols now live in core/config/engine-ops.ts.\n// Codebase map — re-exported from core (engine shim deleted, T1584)\n// Memory engine — brain.db cognitive memory (T5241 cutover)\n// Validate engine — direct from core (was a rename shim, now inlined here)\nexport {\n  addTaskWithSessionScope,\n  completeTaskStrict,\n  configGet,\n  configListPresets,\n  configSet,\n  configSetPreset,\n  coreBatchValidate as validateBatchValidate,\n  coreCoherenceCheck as validateCoherenceCheck,\n  coreComplianceRecord as validateComplianceRecord,\n  coreComplianceSummary as validateComplianceSummary,\n  coreComplianceViolations as validateComplianceViolations,\n  coreTestCoverage as validateTestCoverage,\n  coreTestRun as validateTestRun,\n  coreTestStatus as validateTestStatus,\n  coreValidateManifest as validateManifestOp,\n  coreValidateOutput as validateOutput,\n  coreValidateProtocol as validateProtocol,\n  coreValidateSchema as validateSchemaOp,\n  coreValidateTask as validateTaskOp,\n  type DecisionRecord,\n  ensureInitialized,\n  filterEntries as filterManifestEntries,\n  getVersion,\n  type HookMatrixResult,\n  initProject,\n  isAutoInitEnabled,\n  lifecycleCheck,\n  lifecycleGateFail,\n  lifecycleGatePass,\n  lifecycleGates,\n  lifecycleHistory,\n  lifecyclePrerequisites,\n  lifecycleProgress,\n  lifecycleReset,\n  lifecycleSkip,\n  lifecycleStatus,\n  type ManifestEntry as ResearchManifestEntry,\n  mapCodebase,\n  memoryBrainStats,\n  memoryContradictions,\n  memoryDecisionFind,\n  memoryDecisionStore,\n  memoryFetch,\n  memoryFind,\n  memoryGraphAdd,\n  memoryGraphContext,\n  memoryGraphNeighbors,\n  memoryGraphRelated,\n  memoryGraphRemove,\n  memoryGraphShow,\n  memoryGraphStatsFull,\n  memoryGraphTrace,\n  memoryLearningFind,\n  memoryLearningStats,\n  memoryLearningStore,\n  memoryLink,\n  memoryObserve,\n  memoryPatternFind,\n  memoryPatternStats,\n  memoryPatternStore,\n  memoryQualityReport,\n  memoryReasonSimilar,\n  memoryReasonWhy,\n  memorySearchHybrid,\n  memoryShow,\n  memorySuperseded,\n  memoryTimeline,\n  memoryUnlink,\n  orchestrateAnalyze,\n  orchestrateBootstrap,\n  orchestrateCheck,\n  orchestrateContext,\n  orchestrateCriticalPath,\n  orchestrateHandoff,\n  orchestrateNext,\n  orchestrateParallelEnd,\n  orchestrateParallelStart,\n  orchestratePlan,\n  orchestrateReady,\n  orchestrateReport,\n  orchestrateSkillInject,\n  orchestrateSpawn,\n  orchestrateSpawnExecute,\n  orchestrateStartup,\n  orchestrateStatus,\n  orchestrateUnblockOpportunities,\n  orchestrateValidate,\n  orchestrateWaves,\n  type ProviderMatrixEntry,\n  // Pipeline engine-ops (ENG-MIG-11 / T1578 — migrated to @cleocode/core/internal)\n  // pipeline-engine.ts shrunk to a shim; all symbols now live in core/pipeline/engine-ops.ts.\n  phaseAdvance,\n  phaseComplete,\n  phaseDelete,\n  phaseList,\n  phaseRename,\n  phaseSet,\n  phaseShow,\n  phaseStart,\n  pipelineManifestAppend,\n  pipelineManifestArchive,\n  pipelineManifestFind,\n  pipelineManifestList,\n  pipelineManifestPending,\n  pipelineManifestShow,\n  pipelineManifestStats,\n  queryCommonHooks,\n  queryHookProviders,\n  readManifestEntries,\n  releaseCancel,\n  releaseCommit,\n  releaseGateCheck,\n  releaseGatesRun,\n  releaseIvtrAutoSuggest,\n  releaseList,\n  releaseOpen,\n  releasePlan,\n  releasePrepare,\n  releasePrStatus,\n  releasePush,\n  releaseReconcileV2,\n  releaseRollback,\n  releaseRollbackFull,\n  releaseShow,\n  releaseTag,\n  sessionAdopt,\n  sessionArchive,\n  sessionBriefing,\n  sessionChainShow,\n  sessionCleanup,\n  // T4959: Rich debrief + chain\n  sessionComputeDebrief,\n  sessionComputeHandoff,\n  sessionContextDrift,\n  sessionContextInject,\n  sessionDebriefShow,\n  sessionDecisionLog,\n  sessionEnd,\n  // T5119: Lightweight session discovery\n  sessionFind,\n  sessionGc,\n  sessionHandoff,\n  sessionHistory,\n  sessionList,\n  sessionRecordAssumption,\n  sessionRecordDecision,\n  sessionResume,\n  sessionShow,\n  sessionStart,\n  sessionStats,\n  sessionStatus,\n  sessionSuspend,\n  sessionSwitch,\n  systemHooksMatrix,\n  taskAnalyze,\n  taskArchive,\n  // T11786 (epic T11556) — first-class assignee set/clear (distinct from claim).\n  taskAssignee,\n  taskBatchValidate,\n  taskBlockers,\n  // T11786 (epic T11556) — atomic multi-task status/stage move.\n  taskBulkMove,\n  taskCancel,\n  taskClaim,\n  taskComplete,\n  taskComplexityEstimate,\n  taskCurrentGet,\n  taskDecompose,\n  taskDelete,\n  taskDepends,\n  taskDeps,\n  taskDepsCycles,\n  taskDepsOverview,\n  taskDepsTree,\n  taskDepsValidate,\n  taskExists,\n  taskExport,\n  taskFind,\n  taskHistory,\n  taskImpact,\n  taskImport,\n  taskLabelList,\n  taskLabelShow,\n  taskLint,\n  taskList,\n  taskNext,\n  taskPlan,\n  taskPromote,\n  taskRankingHistory,\n  taskRankingRevert,\n  taskReconcileScope,\n  taskRelates,\n  taskRelatesAdd,\n  taskRelatesAddBatch,\n  taskRelatesFind,\n  taskRelatesRemove,\n  taskReopen,\n  taskReorder,\n  // T11786 (epic T11556) — explicit within-column re-rank from an ID order.\n  taskReorderRank,\n  taskReparent,\n  taskRestore,\n  taskShow,\n  taskShowIvtrHistory,\n  taskShowOperation,\n  taskShowWithHistory,\n  taskSlice,\n  taskStart,\n  taskStats,\n  taskStop,\n  taskSyncLinks,\n  taskSyncLinksRemove,\n  taskSyncReconcile,\n  tasksAddBatchOp,\n  taskTree,\n  taskUnarchive,\n  taskUnclaim,\n  taskUpdate,\n  taskWorkHistory,\n  // T9937 — validate-changelog verb (Saga T9862)\n  validateChangelog,\n  validateGateVerify,\n  // T5327 + T260: Protocol validation operations (12 protocols)\n  validateProtocolArchitectureDecision,\n  validateProtocolArtifactPublish,\n  validateProtocolConsensus,\n  validateProtocolContribution,\n  validateProtocolDecomposition,\n  validateProtocolImplementation,\n  validateProtocolProvenance,\n  validateProtocolRelease,\n  validateProtocolResearch,\n  validateProtocolSpecification,\n  validateProtocolTesting,\n  validateProtocolValidation,\n} from '@cleocode/core/internal';\n// Template parser engine\nexport {\n  generateTemplateConfig,\n  getTemplateForSubcommand,\n  type IssueTemplate,\n  parseIssueTemplates,\n  type TemplateConfig,\n  type TemplateSection,\n  validateLabels,\n} from './template-parser.js';\n","/**\n * Template Parser Engine (Re-export Adapter)\n *\n * Thin re-export from core's templates/parser, adapting the core\n * TemplateResult type to the gateway EngineResult type.\n *\n * All business logic lives in `@cleocode/core/internal`.\n * This file preserves backward compatibility for existing importers.\n *\n * @remarks\n * Relocated from `packages/cleo/src/dispatch/engines/template-parser.ts` into\n * `@cleocode/runtime/gateway` (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) as a\n * dependency of the relocated engine barrel.\n *\n * @task T5705\n * @task T11455\n * @epic T5701\n */\n\nimport {\n  generateTemplateConfig as coreGenerateTemplateConfig,\n  getTemplateForSubcommand as coreGetTemplateForSubcommand,\n  parseIssueTemplates as coreParseIssueTemplates,\n  templates,\n} from '@cleocode/core/internal';\nimport type { EngineResult } from './engine-error.js';\n\n// Re-export types directly from core\nexport type {\n  IssueTemplate,\n  TemplateConfig,\n  TemplateSection,\n} from '@cleocode/core/internal';\n\n/**\n * Adapt a core TemplateResult to an EngineResult.\n * The shapes are compatible -- TemplateResult is a subset of EngineResult.\n */\nfunction adaptResult<T>(result: {\n  success: boolean;\n  data?: T;\n  error?: { code: string; message: string; details?: Record<string, unknown> };\n}): EngineResult<T> {\n  if (result.success) {\n    if (result.data === undefined) {\n      return {\n        success: false,\n        error: { code: 'E_INTERNAL', message: 'Template parser succeeded with no data' },\n      };\n    }\n    return { success: true, data: result.data };\n  }\n  return {\n    success: false,\n    error: result.error\n      ? {\n          code: result.error.code,\n          message: result.error.message,\n          ...(result.error.details ? { details: result.error.details } : {}),\n        }\n      : { code: 'E_INTERNAL', message: 'Unknown error' },\n  };\n}\n\n/**\n * Parse all templates from the repo's .github/ISSUE_TEMPLATE/ directory.\n *\n * @remarks\n * Delegates to the core template parser and adapts the result to the\n * dispatch EngineResult type.\n *\n * @param projectRoot - Absolute path to the project root\n * @returns EngineResult containing the parsed template configuration\n *\n * @example\n * ```typescript\n * const result = parseIssueTemplates('/path/to/project');\n * if (result.success) {\n *   console.log(result.data.templates);\n * }\n * ```\n */\nexport function parseIssueTemplates(\n  projectRoot: string,\n): EngineResult<import('@cleocode/core/internal').TemplateConfig> {\n  return adaptResult(coreParseIssueTemplates(projectRoot));\n}\n\n/**\n * Get template config for a specific subcommand (bug/feature/help).\n *\n * @remarks\n * Looks up a specific template by subcommand name from the project's\n * issue template directory.\n *\n * @param projectRoot - Absolute path to the project root\n * @param subcommand - Template subcommand identifier (e.g. \"bug\", \"feature\")\n * @returns EngineResult containing the matched issue template\n *\n * @example\n * ```typescript\n * const result = getTemplateForSubcommand('/path/to/project', 'bug');\n * ```\n */\nexport function getTemplateForSubcommand(\n  projectRoot: string,\n  subcommand: string,\n): EngineResult<import('@cleocode/core/internal').IssueTemplate> {\n  return adaptResult(coreGetTemplateForSubcommand(projectRoot, subcommand));\n}\n\n/**\n * Generate and cache the config as .cleo/issue-templates.json.\n *\n * @remarks\n * Parses all templates and writes the resulting config to disk for caching.\n *\n * @param projectRoot - Absolute path to the project root\n * @returns EngineResult containing the generated template configuration\n *\n * @example\n * ```typescript\n * const result = await generateTemplateConfig('/path/to/project');\n * ```\n */\nexport async function generateTemplateConfig(\n  projectRoot: string,\n): Promise<EngineResult<import('@cleocode/core/internal').TemplateConfig>> {\n  return adaptResult(await coreGenerateTemplateConfig(projectRoot));\n}\n\n/**\n * Validate that labels exist on a GitHub repo.\n *\n * @remarks\n * Compares a set of required labels against the labels found on the repo.\n *\n * @param labels - Labels required by the template\n * @param repoLabels - Labels that exist on the GitHub repo\n * @returns EngineResult with existing and missing label lists\n *\n * @example\n * ```typescript\n * const result = validateLabels(['bug', 'enhancement'], repoLabels);\n * ```\n */\nexport function validateLabels(\n  labels: string[],\n  repoLabels: string[],\n): EngineResult<{ existing: string[]; missing: string[] }> {\n  return adaptResult(templates.validateLabels(labels, repoLabels));\n}\n","/**\n * Singleton accessor for the gateway {@link BackgroundJobManager}.\n *\n * @remarks\n * Relocated from `packages/cleo/src/dispatch/lib/job-manager-accessor.ts` into\n * `@cleocode/runtime/gateway` (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) so the\n * `admin` domain handler resolves the job-manager singleton from the runtime\n * layer rather than a cleo-internal path. A thin re-export shim remains at the\n * old path so any existing import site compiles unchanged.\n *\n * Long-lived hosts (e.g. the daemon) call {@link setJobManager} once at startup;\n * short-lived CLI invocations leave the singleton `null`, and consumers handle\n * the absence gracefully.\n *\n * @task T4820\n * @task T11455\n */\n\nimport type { BackgroundJobManager } from '@cleocode/core/store/background-jobs.js';\n\n/** Process-wide singleton instance, or `null` when no host has registered one. */\nlet _instance: BackgroundJobManager | null = null;\n\n/**\n * Register the process-wide {@link BackgroundJobManager} singleton.\n *\n * @param manager - The manager to expose, or null to unregister a stopped host.\n * @remarks Hosts unregister before closing their store; absence is reported explicitly.\n */\nexport function setJobManager(manager: BackgroundJobManager | null): void {\n  _instance = manager;\n}\n\n/**\n * Retrieve the registered {@link BackgroundJobManager} singleton.\n *\n * @returns The registered manager, or `null` when running in a short-lived\n * host (e.g. a one-shot CLI invocation) that never called {@link setJobManager}.\n */\nexport function getJobManager(): BackgroundJobManager | null {\n  return _instance;\n}\n","/**\n * Daemon-side gateway server bootstrap — the call-site `cleo daemon serve`\n * drives (T11919).\n *\n * The HTTP gateway adapter (`./http/listen.ts`, T11254) and the supervised\n * `defineGatewaySubsystem` unit (`./daemon-subsystem.ts`, T11451) both already\n * exist, but nothing started them: the daemon had no `serve` call-site. This\n * module is that thin bootstrap — it assembles a {@link SubsystemRegistry} with\n * one scoped gateway subsystem hosting the HTTP transport (loopback by default)\n * over an INJECTED {@link GatewayHandler}, starts it, and returns a live handle\n * with the bound port + an idempotent `close()`.\n *\n * It carries NO `@cleocode/cleo` dependency and NO drizzle (the runtime\n * invariant): the caller (`cleo daemon serve`) injects the assembled CLI gateway\n * handler and the resolved bind coordinates. Secrets never touch the wire —\n * sealed-handle resolution happens server-side inside the dispatched handler,\n * exactly as it does for an in-process CLI call. The HTTP listener binds\n * `127.0.0.1` by default (loopback only); exposing it on a public interface is\n * an explicit caller decision.\n *\n * The streaming transports (SSE — T11921, WS — T11922) extend the SAME\n * subsystem: when their listeners land they bind alongside the unary HTTP server\n * here, so this bootstrap deliberately owns only transport assembly + lifecycle,\n * leaving the per-route seam to the adapter (`parseHttpRoute`).\n *\n * @packageDocumentation\n * @module @cleocode/runtime/gateway\n *\n * @task T11919\n * @epic T11769\n * @saga T10400\n */\n\nimport { defineGatewaySubsystem, type GatewayScope } from './daemon-subsystem.js';\nimport type { GatewayHandler } from './index.js';\n\n/** Default loopback host for the HTTP gateway — local-process-facing only. */\nconst DEFAULT_HOST = '127.0.0.1';\n\n/**\n * Options for {@link serveGateway}.\n *\n * The caller injects the assembled {@link GatewayHandler} and resolves the bind\n * coordinates so the runtime stays free of `@cleocode/paths`/`@cleocode/cleo`.\n */\nexport interface ServeGatewayOptions {\n  /** The transport-neutral gateway handler every hosted transport routes through. */\n  handler: GatewayHandler;\n  /** TCP port to bind. `0` selects an ephemeral port (readable from the handle). */\n  port: number;\n  /** Host/interface to bind. Defaults to `127.0.0.1` (loopback only). */\n  host?: string;\n  /** The scope this gateway process serves. Defaults to `'global'`. */\n  scope?: GatewayScope;\n  /**\n   * Absolute path to the Studio static asset directory (T11979).\n   *\n   * When set, the HTTP server serves the bundled CLEO Web Studio at `/studio`\n   * using the `build/client/` static assets from an `adapter-node` Studio build.\n   * When `undefined`, `/studio` routes return a clean 503 \"bundle absent\" JSON\n   * envelope. The caller resolves this path (typically via\n   * `resolveStudioStaticDir` from `@cleocode/cleo`) so the runtime stays free of\n   * any path-resolution policy.\n   */\n  studioStaticDir?: string;\n}\n\n/**\n * A live gateway server handle returned by {@link serveGateway}.\n *\n * Exposes the actually-bound `port`/`host` (resolved even when `0` was\n * requested) and an idempotent {@link close} for deterministic teardown\n * (daemon shutdown, tests). Mirrors the lower-level\n * {@link import('./http/listen.js').HttpServerHandle} so a test can boot, probe,\n * and tear down on an ephemeral port.\n */\nexport interface ServeGatewayHandle {\n  /** The actually-bound HTTP port (resolved when `0` was requested). */\n  port: number;\n  /** Host/interface the HTTP listener is bound to. */\n  host: string;\n  /** The scope the gateway process serves. */\n  scope: GatewayScope;\n  /** Stop every bound listener (best-effort, idempotent); resolves once closed. */\n  close(): Promise<void>;\n}\n\n/**\n * Boot the HTTP gateway as a supervised subsystem and return a live handle.\n *\n * Declares one scoped gateway subsystem hosting the HTTP transport (loopback\n * default) over the injected handler via {@link defineGatewaySubsystem}, starts\n * it, and reads the actually-bound port from the start context (so the caller —\n * and tests — learn the ephemeral port when `0` was requested). The returned\n * `close()` drives the subsystem's `shutdown(context)` so teardown is the same\n * lifecycle the daemon registry uses for every other supervised concern.\n *\n * Using `defineGatewaySubsystem` directly (rather than a full\n * `SubsystemRegistry`) keeps the bound HTTP handle in reach for the port\n * resolution while still routing through the canonical start→shutdown contract.\n *\n * @param opts - The injected handler + resolved bind coordinates.\n * @returns A promise resolving to the live {@link ServeGatewayHandle}.\n *\n * @example\n * ```ts\n * const handle = await serveGateway({\n *   handler: createCliGatewayHandler(),\n *   port: 0, // ephemeral\n * });\n * // POST http://127.0.0.1:${handle.port}/v1/tasks/show\n * await handle.close();\n * ```\n */\nexport async function serveGateway(opts: ServeGatewayOptions): Promise<ServeGatewayHandle> {\n  const host = opts.host ?? DEFAULT_HOST;\n  const scope: GatewayScope = opts.scope ?? 'global';\n\n  const subsystem = defineGatewaySubsystem({\n    scope,\n    handler: opts.handler,\n    http: { port: opts.port, host, studioStaticDir: opts.studioStaticDir },\n  });\n\n  const context = await subsystem.start();\n  // The HTTP transport is configured, so `start()` always binds it.\n  const boundPort = context.http?.port ?? opts.port;\n\n  let closed = false;\n  return {\n    port: boundPort,\n    host,\n    scope,\n    async close(): Promise<void> {\n      if (closed) return;\n      closed = true;\n      await subsystem.shutdown(context);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA;AAAA,EAEE;AAAA,EAGA;AAAA,OACK;;;ACoBP,SAAS,iBAAiB;AAgEnB,SAAS,qBAAqB,OAA6B;AAChE,SAAO,WAAW,KAAK;AACzB;AA+CO,SAAS,uBACd,MACoC;AACpC,MAAI,KAAK,QAAQ,UAAa,KAAK,SAAS,QAAW;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,qBAAqB,KAAK,KAAK;AAC5C,QAAM,MAAM,UAAU,IAAI;AAM1B,MAAI;AAEJ,SAAO,gBAAyC;AAAA,IAC9C;AAAA,IAEA,MAAM,QAA0C;AAK9C,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,QAAQ,QAAW;AAC1B,gBAAM,MAAM,eAAe,KAAK,SAAS,KAAK,GAAG;AAAA,QACnD;AACA,YAAI;AACJ,YAAI,KAAK,SAAS,QAAW;AAC3B,iBAAO,MAAM,gBAAgB,KAAK,SAAS,KAAK,IAAI;AAAA,QACtD;AACA,cAAM,UAAmC,EAAE,KAAK,QAAQ,KAAK,KAAK,KAAK;AACvE,eAAO;AACP,YAAI;AAAA,UACF,EAAE,OAAO,KAAK,OAAO,KAAK,KAAK,YAAY,UAAU,MAAM,KAAK;AAAA,UAChE;AAAA,QACF;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AAEd,YAAI,QAAQ,QAAW;AACrB,gBAAM,IAAI,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,QACzC;AACA,eAAO;AACP,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,cAA+B;AAG7B,UAAI,SAAS,QAAW;AACtB,cAAM,UAA0B;AAChC,eAAO;AAAA,UACL,UAAU;AAAA,UACV,KAAK;AAAA,UACL,OAAO;AAAA,UACP,eAAe;AAAA,UACf,QAAQ,SAAS,KAAK,KAAK;AAAA,QAC7B;AAAA,MACF;AACA,YAAM,aAAuB,CAAC;AAC9B,UAAI,KAAK,QAAQ,OAAW,YAAW,KAAK,OAAO,KAAK,IAAI,UAAU,EAAE;AACxE,UAAI,KAAK,SAAS,QAAW;AAC3B,mBAAW,KAAK,QAAQ,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE;AAAA,MAC5D;AACA,YAAM,UAA0B;AAChC,aAAO;AAAA,QACL,UAAU;AAAA,QACV,KAAK,KAAK;AAAA,QACV,OAAO;AAAA,QACP,eAAe;AAAA,QACf,QAAQ,SAAS,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,KAAK;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,SAAiD;AAI9D,UAAI,QAAQ,SAAS,QAAW;AAC9B,cAAM,QAAQ,KAAK,MAAM,EAAE,MAAM,CAAC,QAAiB;AACjD,cAAI,KAAK,EAAE,IAAI,GAAG,2BAA2B;AAAA,QAC/C,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,QAAQ,QAAW;AAC7B,cAAM,QAAQ,IAAI,MAAM,EAAE,MAAM,CAAC,QAAiB;AAChD,cAAI,KAAK,EAAE,IAAI,GAAG,0BAA0B;AAAA,QAC9C,CAAC;AAAA,MACH;AACA,aAAO;AACP,UAAI,KAAK,EAAE,OAAO,KAAK,MAAM,GAAG,2BAA2B;AAAA,IAC7D;AAAA,EACF,CAAC;AACH;;;ACpLA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACqB;AAAA,EACC;AAAA,EACE;AAAA,EACC;AAAA,EACG;AAAA,EACR;AAAA,EACL;AAAA,EACG;AAAA,EACM;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EACF;AAAA,EAEpB;AAAA,EACiB;AAAA,EACjB;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;AClSP;AAAA,EACE,0BAA0B;AAAA,EAC1B,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB;AAAA,OACK;AAcP,SAAS,YAAe,QAIJ;AAClB,MAAI,OAAO,SAAS;AAClB,QAAI,OAAO,SAAS,QAAW;AAC7B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,cAAc,SAAS,yCAAyC;AAAA,MACjF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,MAAM,MAAM,OAAO,KAAK;AAAA,EAC5C;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO,OAAO,QACV;AAAA,MACE,MAAM,OAAO,MAAM;AAAA,MACnB,SAAS,OAAO,MAAM;AAAA,MACtB,GAAI,OAAO,MAAM,UAAU,EAAE,SAAS,OAAO,MAAM,QAAQ,IAAI,CAAC;AAAA,IAClE,IACA,EAAE,MAAM,cAAc,SAAS,gBAAgB;AAAA,EACrD;AACF;AAoBO,SAAS,oBACd,aACgE;AAChE,SAAO,YAAY,wBAAwB,WAAW,CAAC;AACzD;AAkBO,SAAS,yBACd,aACA,YAC+D;AAC/D,SAAO,YAAY,6BAA6B,aAAa,UAAU,CAAC;AAC1E;AAgBA,eAAsB,uBACpB,aACyE;AACzE,SAAO,YAAY,MAAM,2BAA2B,WAAW,CAAC;AAClE;AAiBO,SAAS,eACd,QACA,YACyD;AACzD,SAAO,YAAY,UAAU,eAAe,QAAQ,UAAU,CAAC;AACjE;;;AClIA,IAAI,YAAyC;AAQtC,SAAS,cAAc,SAA4C;AACxE,cAAY;AACd;AAQO,SAAS,gBAA6C;AAC3D,SAAO;AACT;;;ACJA,IAAM,eAAe;AA6ErB,eAAsB,aAAa,MAAwD;AACzF,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,QAAsB,KAAK,SAAS;AAE1C,QAAM,YAAY,uBAAuB;AAAA,IACvC;AAAA,IACA,SAAS,KAAK;AAAA,IACd,MAAM,EAAE,MAAM,KAAK,MAAM,MAAM,iBAAiB,KAAK,gBAAgB;AAAA,EACvE,CAAC;AAED,QAAM,UAAU,MAAM,UAAU,MAAM;AAEtC,QAAM,YAAY,QAAQ,MAAM,QAAQ,KAAK;AAE7C,MAAI,SAAS;AACb,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,MAAM,QAAuB;AAC3B,UAAI,OAAQ;AACZ,eAAS;AACT,YAAM,UAAU,SAAS,OAAO;AAAA,IAClC;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../../src/gateway/background-jobs.ts","../../src/gateway/daemon-subsystem.ts","../../src/gateway/engine.ts","../../src/gateway/template-parser.ts","../../src/gateway/job-manager-accessor.ts","../../src/gateway/serve.ts"],"sourcesContent":["/**\n * Background Job Manager — gateway re-export.\n *\n * @remarks\n * The Drizzle-backed background-job manager lives in `@cleocode/core/store`\n * (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) — that is the package which owns the\n * consolidated SQLite schema and the SINGLE `drizzle-orm` instance, so the query\n * builders type-check against one instance (no dual peer-hashed `SQL<unknown>`\n * mismatch under `tsc -b`). This module re-exports that surface so the gateway\n * (and the `@cleocode/runtime/gateway` barrel) expose `BackgroundJobManager` etc.\n * WITHOUT `@cleocode/runtime` taking its own `drizzle-orm` dependency.\n *\n * @task T641\n * @task T11455\n */\n\nexport {\n  type BackgroundJob,\n  BackgroundJobManager,\n  type BackgroundJobManagerConfig,\n  type BackgroundJobStatus,\n  DurableJobStore,\n} from '@cleocode/core/store/background-jobs.js';\n","/**\n * The gateway as a supervised **daemon subsystem**.\n *\n * R3-T7 (this task) closes the loop between the two R-track halves: the R3\n * gateway (dispatcher + the four transport adapters) and the R2 daemon\n * (`defineSubsystem` + the `SubsystemRegistry`). It expresses the\n * external-facing gateway as a uniform {@link Subsystem} so the R2 daemon\n * registry drives its `start → healthProbe → shutdown` lifecycle exactly like\n * every other long-running concern (Studio supervision, the GC cron, …). One\n * gateway subsystem is registered per scope (project / global) → one\n * external-facing gateway process per scope.\n *\n * Which transports the daemon hosts:\n *  - the **RPC unix socket** (`@cleocode/runtime/gateway/rpc`) — the canonical\n *    local-client wire: the `cleo` CLI, Studio's server process, and test\n *    harnesses open it to dispatch without paying a cold `cleo` spawn.\n *  - the **HTTP server** (`@cleocode/runtime/gateway/http` via the daemon-local\n *    `startHttpServer` embedder) — for external clients that speak HTTP rather\n *    than the unix-socket NDJSON wire.\n *\n * The CLI and MCP adapters are intentionally NOT hosted by the daemon: the CLI\n * adapter is in-process to the `cleo` binary, and the MCP adapter is a stdio\n * server an MCP client spawns and owns — neither is a long-lived,\n * daemon-supervised listener. The two external-facing listeners (RPC + HTTP)\n * are the ones the daemon owns.\n *\n * This subsystem adds NO behavior to the adapters themselves — it only wires\n * their existing `start*Server` / `close()` lifecycle (and their already-merged\n * routing) into the daemon registry's uniform lifecycle. It carries NO\n * `@cleocode/cleo` dependency and NO drizzle-orm (the runtime invariant): the\n * caller injects the assembled {@link GatewayHandler} and the resolved bind\n * coordinates; this module only orchestrates listeners.\n *\n * @packageDocumentation\n * @module @cleocode/runtime/gateway\n *\n * @task T11451 (R3-T7)\n * @epic T11254\n * @saga T11243 SG-RUNTIME-UNIFICATION\n */\n\nimport type { Subsystem, SubsystemHealth, SubsystemState } from '@cleocode/contracts';\nimport { getLogger } from '@cleocode/core';\nimport { defineSubsystem } from '../daemon/index.js';\nimport { type HttpServerHandle, type HttpServerOptions, startHttpServer } from './http/listen.js';\nimport type { GatewayHandler } from './index.js';\nimport { type RpcServerHandle, type RpcServerOptions, startRpcServer } from './rpc/index.js';\n\n/** The scope a single gateway process serves — one external-facing process per scope. */\nexport type GatewayScope = 'project' | 'global';\n\n/**\n * Configuration for one scoped gateway subsystem.\n *\n * The caller injects the assembled, transport-neutral {@link GatewayHandler}\n * (built with `createGatewayHandler` from its domain handlers + middleware) and\n * the resolved bind coordinates for each hosted transport. The runtime never\n * resolves paths/ports itself — that keeps it free of `@cleocode/paths` and of\n * any policy decision about where a scope's socket/port lives.\n */\nexport interface GatewaySubsystemOptions {\n  /** The scope this gateway process serves (`project` | `global`). */\n  scope: GatewayScope;\n  /** The transport-neutral gateway handler every hosted transport routes through. */\n  handler: GatewayHandler;\n  /**\n   * RPC unix-socket transport options. When omitted, the RPC transport is not\n   * hosted (a deployment that only wants HTTP). At least one transport MUST be\n   * configured.\n   */\n  rpc?: RpcServerOptions;\n  /**\n   * HTTP transport options. When omitted, the HTTP transport is not hosted (a\n   * deployment that only wants the local RPC socket). At least one transport\n   * MUST be configured.\n   */\n  http?: HttpServerOptions;\n}\n\n/**\n * The live context a started gateway subsystem threads from `start` into\n * `healthProbe`/`shutdown`: the bound transport handles plus the owning pid.\n *\n * `void`-typed contexts are common for subsystems, but the gateway needs to\n * carry its bound handles so `shutdown` can close exactly what `start` opened\n * (and `healthProbe` can report the bound coordinates).\n */\nexport interface GatewaySubsystemContext {\n  /** The OS pid hosting the listeners (this daemon process). */\n  readonly pid: number;\n  /** The bound RPC server handle, when the RPC transport is hosted. */\n  readonly rpc?: RpcServerHandle;\n  /** The bound HTTP server handle, when the HTTP transport is hosted. */\n  readonly http?: HttpServerHandle;\n}\n\n/**\n * The stable subsystem name (and supervised `child_id`) of a scoped gateway.\n *\n * Suffixed with the scope so a single daemon process supervising both scopes\n * (project + global) registers two distinct, non-colliding subsystems. The\n * `child_id` matches the id the Rust supervisor tracks the listener under.\n *\n * @param scope - The gateway scope.\n * @returns The subsystem name, e.g. `gateway-project`.\n */\nexport function gatewaySubsystemName(scope: GatewayScope): string {\n  return `gateway-${scope}`;\n}\n\n/**\n * Declare the external-facing gateway as a supervised daemon {@link Subsystem}.\n *\n * The returned subsystem (frozen by {@link defineSubsystem}) is registered with\n * a `SubsystemRegistry`, which then drives its lifecycle uniformly:\n *\n *  - `start()`       — binds the configured transports (RPC unix socket and/or\n *    HTTP server) over the injected handler, in a fixed order (RPC then HTTP).\n *    If the second listener fails to bind, the first is rolled back so a failed\n *    start leaves no half-open listener — then the error is re-thrown for the\n *    registry's `onError` sink.\n *  - `healthProbe()` — reports a single {@link SubsystemHealth} row keyed on the\n *    scoped `child_id`, `running` while the configured listeners are live, with\n *    a `detail` summarizing the bound coordinates. Projects losslessly onto the\n *    supervisor's `ChildStatus`.\n *  - `shutdown()`    — closes every bound listener (best-effort, idempotent) in\n *    reverse bind order (HTTP then RPC).\n *\n * One subsystem instance is declared per scope, so registering the project and\n * global gateways yields two supervised listeners → one external-facing gateway\n * process surface per scope (AC1).\n *\n * @param opts - The scoped gateway configuration (handler + per-transport bind\n *   coordinates).\n * @returns A frozen {@link Subsystem} ready to `register()` with a\n *   `SubsystemRegistry`.\n * @throws {TypeError} When neither the RPC nor the HTTP transport is configured\n *   (a gateway with no hosted transport serves nothing).\n *\n * @example\n * ```ts\n * const registry = new SubsystemRegistry();\n * registry.register(\n *   defineGatewaySubsystem({\n *     scope: 'project',\n *     handler: createGatewayHandler(dispatcherConfig),\n *     rpc: { socketPath: '/run/cleo/cleo-gateway-rpc-project.sock' },\n *     http: { port: 7777 },\n *   }),\n * );\n * await registry.startAll();        // binds the RPC socket + HTTP server\n * const health = await registry.aggregateHealth();\n * await registry.shutdownAll();     // closes both listeners\n * ```\n */\nexport function defineGatewaySubsystem(\n  opts: GatewaySubsystemOptions,\n): Subsystem<GatewaySubsystemContext> {\n  if (opts.rpc === undefined && opts.http === undefined) {\n    throw new TypeError(\n      'defineGatewaySubsystem: at least one transport (rpc and/or http) must be configured',\n    );\n  }\n\n  const name = gatewaySubsystemName(opts.scope);\n  const log = getLogger(name);\n\n  // The `Subsystem.healthProbe` contract takes NO arguments — the registry only\n  // threads the start→shutdown context, not into the probe. We therefore hold\n  // the live context in a closure so `healthProbe()` can read the bound handles\n  // (and report `stopped` before `start()`/after `shutdown()`).\n  let live: GatewaySubsystemContext | undefined;\n\n  return defineSubsystem<GatewaySubsystemContext>({\n    name,\n\n    async start(): Promise<GatewaySubsystemContext> {\n      // Bind RPC first, then HTTP, so the unix socket is available before the\n      // HTTP listener (the canonical local wire comes up first). On an HTTP\n      // bind failure, roll back the RPC socket so start() never leaves a\n      // half-open listener for the registry's onError to clean up after.\n      let rpc: RpcServerHandle | undefined;\n      try {\n        if (opts.rpc !== undefined) {\n          rpc = await startRpcServer(opts.handler, opts.rpc);\n        }\n        let http: HttpServerHandle | undefined;\n        if (opts.http !== undefined) {\n          http = await startHttpServer(opts.handler, opts.http);\n        }\n        const context: GatewaySubsystemContext = { pid: process.pid, rpc, http };\n        live = context;\n        log.info(\n          { scope: opts.scope, rpc: rpc?.socketPath, httpPort: http?.port },\n          'gateway subsystem started',\n        );\n        return context;\n      } catch (cause) {\n        // Roll back any listener already bound before re-throwing.\n        if (rpc !== undefined) {\n          await rpc.close().catch(() => undefined);\n        }\n        live = undefined;\n        throw cause;\n      }\n    },\n\n    healthProbe(): SubsystemHealth {\n      // Not started (or already shut down) → report a stopped row so the\n      // aggregate `allHealthy` cannot be falsely true.\n      if (live === undefined) {\n        const stopped: SubsystemState = 'stopped';\n        return {\n          child_id: name,\n          pid: 0,\n          state: stopped,\n          restart_count: 0,\n          detail: `scope=${opts.scope} not started`,\n        };\n      }\n      const transports: string[] = [];\n      if (live.rpc !== undefined) transports.push(`rpc=${live.rpc.socketPath}`);\n      if (live.http !== undefined) {\n        transports.push(`http=${live.http.host}:${live.http.port}`);\n      }\n      const running: SubsystemState = 'running';\n      return {\n        child_id: name,\n        pid: live.pid,\n        state: running,\n        restart_count: 0,\n        detail: `scope=${opts.scope} ${transports.join(' ')}`.trim(),\n      };\n    },\n\n    async shutdown(context: GatewaySubsystemContext): Promise<void> {\n      // Reverse bind order: close HTTP before the RPC socket. Both close()\n      // calls are idempotent and best-effort — one failure must not block the\n      // other listener's teardown.\n      if (context.http !== undefined) {\n        await context.http.close().catch((err: unknown) => {\n          log.warn({ err }, 'gateway http close failed');\n        });\n      }\n      if (context.rpc !== undefined) {\n        await context.rpc.close().catch((err: unknown) => {\n          log.warn({ err }, 'gateway rpc close failed');\n        });\n      }\n      live = undefined;\n      log.info({ scope: opts.scope }, 'gateway subsystem stopped');\n    },\n  });\n}\n","/**\n * Engine Re-exports for Gateway Domain Handlers\n *\n * Centralizes the engine imports consumed by the domain handlers into a single\n * barrel. Every symbol re-exported here ultimately resolves to\n * `@cleocode/core/internal` (the canonical business-logic SSoT) or core's\n * template parser — this file adds NO logic of its own.\n *\n * @remarks\n * Relocated from `packages/cleo/src/dispatch/lib/engine.ts` into\n * `@cleocode/runtime/gateway` (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) so the\n * runtime can assemble the handler map without importing `@cleocode/cleo`.\n * Mirrors the `meta` / `registry` / `dispatcher` relocations (R3-T3 · T11447).\n * A thin re-export shim remains at the old `lib/engine.ts` path so the\n * in-package import sites compile unchanged (zero behavior change).\n *\n * @epic T4820\n * @task T4815\n * @task T11455\n */\n\nexport type { MinimalTaskRecord, Session as SessionRecord, TaskRecord } from '@cleocode/contracts';\nexport type { OrchestratePlanResult } from '@cleocode/contracts/operations/orchestrate';\n// Task operations — re-exported from @cleocode/core/internal (T1568 / ADR-057 / ADR-058)\n// task-engine.ts was deleted in Wave 5; all symbols now live in core/tasks/.\n// Orchestrate — types and functions from @cleocode/core/internal (T1570 ADR-057)\n// System — type aliases for backward compat (T1571: system-engine.ts deleted, canonical sources = @cleocode/core/internal)\nexport type {\n  ArchiveStatsResult as ArchiveStatsData,\n  AuditResult as AuditData,\n  BackupEntry as BackupEntryData,\n  BackupResult as BackupData,\n  CleanupResult as CleanupData,\n  CompactTask,\n  ComplianceData,\n  ContextData,\n  DashboardData,\n  DiagnosticsResult as DiagnosticsData,\n  FileRestoreResult,\n  HealthResult as HealthData,\n  HelpData,\n  InjectGenerateResult as InjectGenerateData,\n  IvtrHistoryEntry,\n  LabelsResult as LabelsData,\n  LifecycleStageEntry,\n  LogQueryData,\n  MigrateResult as MigrateData,\n  OrchestratePlanInput,\n  PathsData,\n  PlanWarning,\n  PlanWave,\n  PlanWorkerEntry,\n  RestoreResult as RestoreData,\n  RuntimeDiagnostics as RuntimeData,\n  SafestopResult as SafestopData,\n  ScaffoldHubData,\n  StatsData,\n  SyncData,\n  SystemMetricsResult as MetricsData,\n  UncancelResult as UncancelData,\n} from '@cleocode/core/internal';\n// Pipeline manifest functions (moved from memory domain in T5241)\n// Release engine (T1572 — ENG-MIG-5: migrated to @cleocode/core/internal)\n// Session engine (T1573 — ENG-MIG-6: migrated to @cleocode/core/internal)\n// Lifecycle engine ops — re-exported from @cleocode/core/internal (T1576 / ENG-MIG-9 / ADR-057)\n// lifecycle-engine.ts shrunk to a shim; all symbols now live in core/lifecycle/engine-ops.ts.\n// Hooks engine (ENG-MIG-12 / T1579 — logic in @cleocode/core/internal)\n// Init engine-ops — migrated to @cleocode/core/internal (ENG-MIG-14 / T1581 / ADR-057)\n// Config engine-ops — migrated to @cleocode/core/internal (ENG-MIG-15 / T1582 / ADR-057)\n// config-engine.ts shrunk to a shim; all symbols now live in core/config/engine-ops.ts.\n// Codebase map — re-exported from core (engine shim deleted, T1584)\n// Memory engine — brain.db cognitive memory (T5241 cutover)\n// Validate engine — direct from core (was a rename shim, now inlined here)\nexport {\n  addTaskWithSessionScope,\n  completeTaskStrict,\n  configGet,\n  configListPresets,\n  configSet,\n  configSetPreset,\n  coreBatchValidate as validateBatchValidate,\n  coreCoherenceCheck as validateCoherenceCheck,\n  coreComplianceRecord as validateComplianceRecord,\n  coreComplianceSummary as validateComplianceSummary,\n  coreComplianceViolations as validateComplianceViolations,\n  coreTestCoverage as validateTestCoverage,\n  coreTestRun as validateTestRun,\n  coreTestStatus as validateTestStatus,\n  coreValidateManifest as validateManifestOp,\n  coreValidateOutput as validateOutput,\n  coreValidateProtocol as validateProtocol,\n  coreValidateSchema as validateSchemaOp,\n  coreValidateTask as validateTaskOp,\n  type DecisionRecord,\n  ensureInitialized,\n  filterEntries as filterManifestEntries,\n  getVersion,\n  type HookMatrixResult,\n  initProject,\n  isAutoInitEnabled,\n  lifecycleCheck,\n  lifecycleGateFail,\n  lifecycleGatePass,\n  lifecycleGates,\n  lifecycleHistory,\n  lifecyclePrerequisites,\n  lifecycleProgress,\n  lifecycleReset,\n  lifecycleSkip,\n  lifecycleStatus,\n  type ManifestEntry as ResearchManifestEntry,\n  mapCodebase,\n  memoryBrainStats,\n  memoryContradictions,\n  memoryDecisionFind,\n  memoryDecisionStore,\n  memoryFetch,\n  memoryFind,\n  memoryGraphAdd,\n  memoryGraphContext,\n  memoryGraphNeighbors,\n  memoryGraphRelated,\n  memoryGraphRemove,\n  memoryGraphShow,\n  memoryGraphStatsFull,\n  memoryGraphTrace,\n  memoryLearningFind,\n  memoryLearningStats,\n  memoryLearningStore,\n  memoryLink,\n  memoryObserve,\n  memoryPatternFind,\n  memoryPatternStats,\n  memoryPatternStore,\n  memoryQualityReport,\n  memoryReasonSimilar,\n  memoryReasonWhy,\n  memorySearchHybrid,\n  memoryShow,\n  memorySuperseded,\n  memoryTimeline,\n  memoryUnlink,\n  orchestrateAnalyze,\n  orchestrateBootstrap,\n  orchestrateCheck,\n  orchestrateContext,\n  orchestrateCriticalPath,\n  orchestrateHandoff,\n  orchestrateNext,\n  orchestrateParallelEnd,\n  orchestrateParallelStart,\n  orchestratePlan,\n  orchestrateReady,\n  orchestrateReport,\n  orchestrateSkillInject,\n  orchestrateSpawn,\n  orchestrateSpawnExecute,\n  orchestrateStartup,\n  orchestrateStatus,\n  orchestrateUnblockOpportunities,\n  orchestrateValidate,\n  orchestrateWaves,\n  type ProviderMatrixEntry,\n  // Pipeline engine-ops (ENG-MIG-11 / T1578 — migrated to @cleocode/core/internal)\n  // pipeline-engine.ts shrunk to a shim; all symbols now live in core/pipeline/engine-ops.ts.\n  phaseAdvance,\n  phaseComplete,\n  phaseDelete,\n  phaseList,\n  phaseRename,\n  phaseSet,\n  phaseShow,\n  phaseStart,\n  pipelineManifestAppend,\n  pipelineManifestArchive,\n  pipelineManifestFind,\n  pipelineManifestList,\n  pipelineManifestPending,\n  pipelineManifestShow,\n  pipelineManifestStats,\n  queryCommonHooks,\n  queryHookProviders,\n  readManifestEntries,\n  releaseCancel,\n  releaseChangelog,\n  releaseCommit,\n  releaseCut,\n  releaseGateCheck,\n  releaseGatesRun,\n  releaseIvtrAutoSuggest,\n  releaseList,\n  releaseOpen,\n  releasePlan,\n  releasePrepare,\n  releasePrStatus,\n  releasePush,\n  releaseReconcileV2,\n  releaseRollback,\n  releaseRollbackFull,\n  releaseShow,\n  releaseTag,\n  releaseVerifyTag,\n  sessionAdopt,\n  sessionArchive,\n  sessionBriefing,\n  sessionChainShow,\n  sessionCleanup,\n  // T4959: Rich debrief + chain\n  sessionComputeDebrief,\n  sessionComputeHandoff,\n  sessionContextDrift,\n  sessionContextInject,\n  sessionDebriefShow,\n  sessionDecisionLog,\n  sessionEnd,\n  // T5119: Lightweight session discovery\n  sessionFind,\n  sessionGc,\n  sessionHandoff,\n  sessionHistory,\n  sessionList,\n  sessionRecordAssumption,\n  sessionRecordDecision,\n  sessionResume,\n  sessionShow,\n  sessionStart,\n  sessionStats,\n  sessionStatus,\n  sessionSuspend,\n  sessionSwitch,\n  systemHooksMatrix,\n  taskAnalyze,\n  taskArchive,\n  // T11786 (epic T11556) — first-class assignee set/clear (distinct from claim).\n  taskAssignee,\n  taskBatchValidate,\n  taskBlockers,\n  // T11786 (epic T11556) — atomic multi-task status/stage move.\n  taskBulkMove,\n  taskCancel,\n  taskClaim,\n  taskComplete,\n  taskComplexityEstimate,\n  taskCurrentGet,\n  taskDecompose,\n  taskDelete,\n  taskDepends,\n  taskDeps,\n  taskDepsCycles,\n  taskDepsOverview,\n  taskDepsTree,\n  taskDepsValidate,\n  taskExists,\n  taskExport,\n  taskFind,\n  taskHistory,\n  taskImpact,\n  taskImport,\n  taskLabelList,\n  taskLabelShow,\n  taskLint,\n  taskList,\n  taskNext,\n  taskPlan,\n  taskPromote,\n  taskRankingHistory,\n  taskRankingRevert,\n  taskReconcileScope,\n  taskRelates,\n  taskRelatesAdd,\n  taskRelatesAddBatch,\n  taskRelatesFind,\n  taskRelatesRemove,\n  taskReopen,\n  taskReorder,\n  // T11786 (epic T11556) — explicit within-column re-rank from an ID order.\n  taskReorderRank,\n  taskReparent,\n  taskRestore,\n  taskShow,\n  taskShowIvtrHistory,\n  taskShowOperation,\n  taskShowWithHistory,\n  taskSlice,\n  taskStart,\n  taskStats,\n  taskStop,\n  taskSyncLinks,\n  taskSyncLinksRemove,\n  taskSyncReconcile,\n  tasksAddBatchOp,\n  taskTree,\n  taskUnarchive,\n  taskUnclaim,\n  taskUpdate,\n  taskWorkHistory,\n  // T9937 — validate-changelog verb (Saga T9862)\n  validateChangelog,\n  validateGateVerify,\n  // T5327 + T260: Protocol validation operations (12 protocols)\n  validateProtocolArchitectureDecision,\n  validateProtocolArtifactPublish,\n  validateProtocolConsensus,\n  validateProtocolContribution,\n  validateProtocolDecomposition,\n  validateProtocolImplementation,\n  validateProtocolProvenance,\n  validateProtocolRelease,\n  validateProtocolResearch,\n  validateProtocolSpecification,\n  validateProtocolTesting,\n  validateProtocolValidation,\n} from '@cleocode/core/internal';\n// Template parser engine\nexport {\n  generateTemplateConfig,\n  getTemplateForSubcommand,\n  type IssueTemplate,\n  parseIssueTemplates,\n  type TemplateConfig,\n  type TemplateSection,\n  validateLabels,\n} from './template-parser.js';\n","/**\n * Template Parser Engine (Re-export Adapter)\n *\n * Thin re-export from core's templates/parser, adapting the core\n * TemplateResult type to the gateway EngineResult type.\n *\n * All business logic lives in `@cleocode/core/internal`.\n * This file preserves backward compatibility for existing importers.\n *\n * @remarks\n * Relocated from `packages/cleo/src/dispatch/engines/template-parser.ts` into\n * `@cleocode/runtime/gateway` (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) as a\n * dependency of the relocated engine barrel.\n *\n * @task T5705\n * @task T11455\n * @epic T5701\n */\n\nimport {\n  generateTemplateConfig as coreGenerateTemplateConfig,\n  getTemplateForSubcommand as coreGetTemplateForSubcommand,\n  parseIssueTemplates as coreParseIssueTemplates,\n  templates,\n} from '@cleocode/core/internal';\nimport type { EngineResult } from './engine-error.js';\n\n// Re-export types directly from core\nexport type {\n  IssueTemplate,\n  TemplateConfig,\n  TemplateSection,\n} from '@cleocode/core/internal';\n\n/**\n * Adapt a core TemplateResult to an EngineResult.\n * The shapes are compatible -- TemplateResult is a subset of EngineResult.\n */\nfunction adaptResult<T>(result: {\n  success: boolean;\n  data?: T;\n  error?: { code: string; message: string; details?: Record<string, unknown> };\n}): EngineResult<T> {\n  if (result.success) {\n    if (result.data === undefined) {\n      return {\n        success: false,\n        error: { code: 'E_INTERNAL', message: 'Template parser succeeded with no data' },\n      };\n    }\n    return { success: true, data: result.data };\n  }\n  return {\n    success: false,\n    error: result.error\n      ? {\n          code: result.error.code,\n          message: result.error.message,\n          ...(result.error.details ? { details: result.error.details } : {}),\n        }\n      : { code: 'E_INTERNAL', message: 'Unknown error' },\n  };\n}\n\n/**\n * Parse all templates from the repo's .github/ISSUE_TEMPLATE/ directory.\n *\n * @remarks\n * Delegates to the core template parser and adapts the result to the\n * dispatch EngineResult type.\n *\n * @param projectRoot - Absolute path to the project root\n * @returns EngineResult containing the parsed template configuration\n *\n * @example\n * ```typescript\n * const result = parseIssueTemplates('/path/to/project');\n * if (result.success) {\n *   console.log(result.data.templates);\n * }\n * ```\n */\nexport function parseIssueTemplates(\n  projectRoot: string,\n): EngineResult<import('@cleocode/core/internal').TemplateConfig> {\n  return adaptResult(coreParseIssueTemplates(projectRoot));\n}\n\n/**\n * Get template config for a specific subcommand (bug/feature/help).\n *\n * @remarks\n * Looks up a specific template by subcommand name from the project's\n * issue template directory.\n *\n * @param projectRoot - Absolute path to the project root\n * @param subcommand - Template subcommand identifier (e.g. \"bug\", \"feature\")\n * @returns EngineResult containing the matched issue template\n *\n * @example\n * ```typescript\n * const result = getTemplateForSubcommand('/path/to/project', 'bug');\n * ```\n */\nexport function getTemplateForSubcommand(\n  projectRoot: string,\n  subcommand: string,\n): EngineResult<import('@cleocode/core/internal').IssueTemplate> {\n  return adaptResult(coreGetTemplateForSubcommand(projectRoot, subcommand));\n}\n\n/**\n * Generate and cache the config as .cleo/issue-templates.json.\n *\n * @remarks\n * Parses all templates and writes the resulting config to disk for caching.\n *\n * @param projectRoot - Absolute path to the project root\n * @returns EngineResult containing the generated template configuration\n *\n * @example\n * ```typescript\n * const result = await generateTemplateConfig('/path/to/project');\n * ```\n */\nexport async function generateTemplateConfig(\n  projectRoot: string,\n): Promise<EngineResult<import('@cleocode/core/internal').TemplateConfig>> {\n  return adaptResult(await coreGenerateTemplateConfig(projectRoot));\n}\n\n/**\n * Validate that labels exist on a GitHub repo.\n *\n * @remarks\n * Compares a set of required labels against the labels found on the repo.\n *\n * @param labels - Labels required by the template\n * @param repoLabels - Labels that exist on the GitHub repo\n * @returns EngineResult with existing and missing label lists\n *\n * @example\n * ```typescript\n * const result = validateLabels(['bug', 'enhancement'], repoLabels);\n * ```\n */\nexport function validateLabels(\n  labels: string[],\n  repoLabels: string[],\n): EngineResult<{ existing: string[]; missing: string[] }> {\n  return adaptResult(templates.validateLabels(labels, repoLabels));\n}\n","/**\n * Singleton accessor for the gateway {@link BackgroundJobManager}.\n *\n * @remarks\n * Relocated from `packages/cleo/src/dispatch/lib/job-manager-accessor.ts` into\n * `@cleocode/runtime/gateway` (R3-K1 · T11455 · SG-RUNTIME-UNIFICATION) so the\n * `admin` domain handler resolves the job-manager singleton from the runtime\n * layer rather than a cleo-internal path. A thin re-export shim remains at the\n * old path so any existing import site compiles unchanged.\n *\n * Long-lived hosts (e.g. the daemon) call {@link setJobManager} once at startup;\n * short-lived CLI invocations leave the singleton `null`, and consumers handle\n * the absence gracefully.\n *\n * @task T4820\n * @task T11455\n */\n\nimport type { BackgroundJobManager } from '@cleocode/core/store/background-jobs.js';\n\n/** Process-wide singleton instance, or `null` when no host has registered one. */\nlet _instance: BackgroundJobManager | null = null;\n\n/**\n * Register the process-wide {@link BackgroundJobManager} singleton.\n *\n * @param manager - The manager to expose, or null to unregister a stopped host.\n * @remarks Hosts unregister before closing their store; absence is reported explicitly.\n */\nexport function setJobManager(manager: BackgroundJobManager | null): void {\n  _instance = manager;\n}\n\n/**\n * Retrieve the registered {@link BackgroundJobManager} singleton.\n *\n * @returns The registered manager, or `null` when running in a short-lived\n * host (e.g. a one-shot CLI invocation) that never called {@link setJobManager}.\n */\nexport function getJobManager(): BackgroundJobManager | null {\n  return _instance;\n}\n","/**\n * Daemon-side gateway server bootstrap — the call-site `cleo daemon serve`\n * drives (T11919).\n *\n * The HTTP gateway adapter (`./http/listen.ts`, T11254) and the supervised\n * `defineGatewaySubsystem` unit (`./daemon-subsystem.ts`, T11451) both already\n * exist, but nothing started them: the daemon had no `serve` call-site. This\n * module is that thin bootstrap — it assembles a {@link SubsystemRegistry} with\n * one scoped gateway subsystem hosting the HTTP transport (loopback by default)\n * over an INJECTED {@link GatewayHandler}, starts it, and returns a live handle\n * with the bound port + an idempotent `close()`.\n *\n * It carries NO `@cleocode/cleo` dependency and NO drizzle (the runtime\n * invariant): the caller (`cleo daemon serve`) injects the assembled CLI gateway\n * handler and the resolved bind coordinates. Secrets never touch the wire —\n * sealed-handle resolution happens server-side inside the dispatched handler,\n * exactly as it does for an in-process CLI call. The HTTP listener binds\n * `127.0.0.1` by default (loopback only); exposing it on a public interface is\n * an explicit caller decision.\n *\n * The streaming transports (SSE — T11921, WS — T11922) extend the SAME\n * subsystem: when their listeners land they bind alongside the unary HTTP server\n * here, so this bootstrap deliberately owns only transport assembly + lifecycle,\n * leaving the per-route seam to the adapter (`parseHttpRoute`).\n *\n * @packageDocumentation\n * @module @cleocode/runtime/gateway\n *\n * @task T11919\n * @epic T11769\n * @saga T10400\n */\n\nimport { defineGatewaySubsystem, type GatewayScope } from './daemon-subsystem.js';\nimport type { GatewayHandler } from './index.js';\n\n/** Default loopback host for the HTTP gateway — local-process-facing only. */\nconst DEFAULT_HOST = '127.0.0.1';\n\n/**\n * Options for {@link serveGateway}.\n *\n * The caller injects the assembled {@link GatewayHandler} and resolves the bind\n * coordinates so the runtime stays free of `@cleocode/paths`/`@cleocode/cleo`.\n */\nexport interface ServeGatewayOptions {\n  /** The transport-neutral gateway handler every hosted transport routes through. */\n  handler: GatewayHandler;\n  /** TCP port to bind. `0` selects an ephemeral port (readable from the handle). */\n  port: number;\n  /** Host/interface to bind. Defaults to `127.0.0.1` (loopback only). */\n  host?: string;\n  /** The scope this gateway process serves. Defaults to `'global'`. */\n  scope?: GatewayScope;\n  /**\n   * Absolute path to the Studio static asset directory (T11979).\n   *\n   * When set, the HTTP server serves the bundled CLEO Web Studio at `/studio`\n   * using the `build/client/` static assets from an `adapter-node` Studio build.\n   * When `undefined`, `/studio` routes return a clean 503 \"bundle absent\" JSON\n   * envelope. The caller resolves this path (typically via\n   * `resolveStudioStaticDir` from `@cleocode/cleo`) so the runtime stays free of\n   * any path-resolution policy.\n   */\n  studioStaticDir?: string;\n}\n\n/**\n * A live gateway server handle returned by {@link serveGateway}.\n *\n * Exposes the actually-bound `port`/`host` (resolved even when `0` was\n * requested) and an idempotent {@link close} for deterministic teardown\n * (daemon shutdown, tests). Mirrors the lower-level\n * {@link import('./http/listen.js').HttpServerHandle} so a test can boot, probe,\n * and tear down on an ephemeral port.\n */\nexport interface ServeGatewayHandle {\n  /** The actually-bound HTTP port (resolved when `0` was requested). */\n  port: number;\n  /** Host/interface the HTTP listener is bound to. */\n  host: string;\n  /** The scope the gateway process serves. */\n  scope: GatewayScope;\n  /** Stop every bound listener (best-effort, idempotent); resolves once closed. */\n  close(): Promise<void>;\n}\n\n/**\n * Boot the HTTP gateway as a supervised subsystem and return a live handle.\n *\n * Declares one scoped gateway subsystem hosting the HTTP transport (loopback\n * default) over the injected handler via {@link defineGatewaySubsystem}, starts\n * it, and reads the actually-bound port from the start context (so the caller —\n * and tests — learn the ephemeral port when `0` was requested). The returned\n * `close()` drives the subsystem's `shutdown(context)` so teardown is the same\n * lifecycle the daemon registry uses for every other supervised concern.\n *\n * Using `defineGatewaySubsystem` directly (rather than a full\n * `SubsystemRegistry`) keeps the bound HTTP handle in reach for the port\n * resolution while still routing through the canonical start→shutdown contract.\n *\n * @param opts - The injected handler + resolved bind coordinates.\n * @returns A promise resolving to the live {@link ServeGatewayHandle}.\n *\n * @example\n * ```ts\n * const handle = await serveGateway({\n *   handler: createCliGatewayHandler(),\n *   port: 0, // ephemeral\n * });\n * // POST http://127.0.0.1:${handle.port}/v1/tasks/show\n * await handle.close();\n * ```\n */\nexport async function serveGateway(opts: ServeGatewayOptions): Promise<ServeGatewayHandle> {\n  const host = opts.host ?? DEFAULT_HOST;\n  const scope: GatewayScope = opts.scope ?? 'global';\n\n  const subsystem = defineGatewaySubsystem({\n    scope,\n    handler: opts.handler,\n    http: { port: opts.port, host, studioStaticDir: opts.studioStaticDir },\n  });\n\n  const context = await subsystem.start();\n  // The HTTP transport is configured, so `start()` always binds it.\n  const boundPort = context.http?.port ?? opts.port;\n\n  let closed = false;\n  return {\n    port: boundPort,\n    host,\n    scope,\n    async close(): Promise<void> {\n      if (closed) return;\n      closed = true;\n      await subsystem.shutdown(context);\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA;AAAA,EAEE;AAAA,EAGA;AAAA,OACK;;;ACoBP,SAAS,iBAAiB;AAgEnB,SAAS,qBAAqB,OAA6B;AAChE,SAAO,WAAW,KAAK;AACzB;AA+CO,SAAS,uBACd,MACoC;AACpC,MAAI,KAAK,QAAQ,UAAa,KAAK,SAAS,QAAW;AACrD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,qBAAqB,KAAK,KAAK;AAC5C,QAAM,MAAM,UAAU,IAAI;AAM1B,MAAI;AAEJ,SAAO,gBAAyC;AAAA,IAC9C;AAAA,IAEA,MAAM,QAA0C;AAK9C,UAAI;AACJ,UAAI;AACF,YAAI,KAAK,QAAQ,QAAW;AAC1B,gBAAM,MAAM,eAAe,KAAK,SAAS,KAAK,GAAG;AAAA,QACnD;AACA,YAAI;AACJ,YAAI,KAAK,SAAS,QAAW;AAC3B,iBAAO,MAAM,gBAAgB,KAAK,SAAS,KAAK,IAAI;AAAA,QACtD;AACA,cAAM,UAAmC,EAAE,KAAK,QAAQ,KAAK,KAAK,KAAK;AACvE,eAAO;AACP,YAAI;AAAA,UACF,EAAE,OAAO,KAAK,OAAO,KAAK,KAAK,YAAY,UAAU,MAAM,KAAK;AAAA,UAChE;AAAA,QACF;AACA,eAAO;AAAA,MACT,SAAS,OAAO;AAEd,YAAI,QAAQ,QAAW;AACrB,gBAAM,IAAI,MAAM,EAAE,MAAM,MAAM,MAAS;AAAA,QACzC;AACA,eAAO;AACP,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IAEA,cAA+B;AAG7B,UAAI,SAAS,QAAW;AACtB,cAAM,UAA0B;AAChC,eAAO;AAAA,UACL,UAAU;AAAA,UACV,KAAK;AAAA,UACL,OAAO;AAAA,UACP,eAAe;AAAA,UACf,QAAQ,SAAS,KAAK,KAAK;AAAA,QAC7B;AAAA,MACF;AACA,YAAM,aAAuB,CAAC;AAC9B,UAAI,KAAK,QAAQ,OAAW,YAAW,KAAK,OAAO,KAAK,IAAI,UAAU,EAAE;AACxE,UAAI,KAAK,SAAS,QAAW;AAC3B,mBAAW,KAAK,QAAQ,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,EAAE;AAAA,MAC5D;AACA,YAAM,UAA0B;AAChC,aAAO;AAAA,QACL,UAAU;AAAA,QACV,KAAK,KAAK;AAAA,QACV,OAAO;AAAA,QACP,eAAe;AAAA,QACf,QAAQ,SAAS,KAAK,KAAK,IAAI,WAAW,KAAK,GAAG,CAAC,GAAG,KAAK;AAAA,MAC7D;AAAA,IACF;AAAA,IAEA,MAAM,SAAS,SAAiD;AAI9D,UAAI,QAAQ,SAAS,QAAW;AAC9B,cAAM,QAAQ,KAAK,MAAM,EAAE,MAAM,CAAC,QAAiB;AACjD,cAAI,KAAK,EAAE,IAAI,GAAG,2BAA2B;AAAA,QAC/C,CAAC;AAAA,MACH;AACA,UAAI,QAAQ,QAAQ,QAAW;AAC7B,cAAM,QAAQ,IAAI,MAAM,EAAE,MAAM,CAAC,QAAiB;AAChD,cAAI,KAAK,EAAE,IAAI,GAAG,0BAA0B;AAAA,QAC9C,CAAC;AAAA,MACH;AACA,aAAO;AACP,UAAI,KAAK,EAAE,OAAO,KAAK,MAAM,GAAG,2BAA2B;AAAA,IAC7D;AAAA,EACF,CAAC;AACH;;;ACpLA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACqB;AAAA,EACC;AAAA,EACE;AAAA,EACC;AAAA,EACG;AAAA,EACR;AAAA,EACL;AAAA,EACG;AAAA,EACM;AAAA,EACF;AAAA,EACE;AAAA,EACF;AAAA,EACF;AAAA,EAEpB;AAAA,EACiB;AAAA,EACjB;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;;;ACrSP;AAAA,EACE,0BAA0B;AAAA,EAC1B,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB;AAAA,OACK;AAcP,SAAS,YAAe,QAIJ;AAClB,MAAI,OAAO,SAAS;AAClB,QAAI,OAAO,SAAS,QAAW;AAC7B,aAAO;AAAA,QACL,SAAS;AAAA,QACT,OAAO,EAAE,MAAM,cAAc,SAAS,yCAAyC;AAAA,MACjF;AAAA,IACF;AACA,WAAO,EAAE,SAAS,MAAM,MAAM,OAAO,KAAK;AAAA,EAC5C;AACA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,OAAO,OAAO,QACV;AAAA,MACE,MAAM,OAAO,MAAM;AAAA,MACnB,SAAS,OAAO,MAAM;AAAA,MACtB,GAAI,OAAO,MAAM,UAAU,EAAE,SAAS,OAAO,MAAM,QAAQ,IAAI,CAAC;AAAA,IAClE,IACA,EAAE,MAAM,cAAc,SAAS,gBAAgB;AAAA,EACrD;AACF;AAoBO,SAAS,oBACd,aACgE;AAChE,SAAO,YAAY,wBAAwB,WAAW,CAAC;AACzD;AAkBO,SAAS,yBACd,aACA,YAC+D;AAC/D,SAAO,YAAY,6BAA6B,aAAa,UAAU,CAAC;AAC1E;AAgBA,eAAsB,uBACpB,aACyE;AACzE,SAAO,YAAY,MAAM,2BAA2B,WAAW,CAAC;AAClE;AAiBO,SAAS,eACd,QACA,YACyD;AACzD,SAAO,YAAY,UAAU,eAAe,QAAQ,UAAU,CAAC;AACjE;;;AClIA,IAAI,YAAyC;AAQtC,SAAS,cAAc,SAA4C;AACxE,cAAY;AACd;AAQO,SAAS,gBAA6C;AAC3D,SAAO;AACT;;;ACJA,IAAM,eAAe;AA6ErB,eAAsB,aAAa,MAAwD;AACzF,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,QAAsB,KAAK,SAAS;AAE1C,QAAM,YAAY,uBAAuB;AAAA,IACvC;AAAA,IACA,SAAS,KAAK;AAAA,IACd,MAAM,EAAE,MAAM,KAAK,MAAM,MAAM,iBAAiB,KAAK,gBAAgB;AAAA,EACvE,CAAC;AAED,QAAM,UAAU,MAAM,UAAU,MAAM;AAEtC,QAAM,YAAY,QAAQ,MAAM,QAAQ,KAAK;AAE7C,MAAI,SAAS;AACb,SAAO;AAAA,IACL,MAAM;AAAA,IACN;AAAA,IACA;AAAA,IACA,MAAM,QAAuB;AAC3B,UAAI,OAAQ;AACZ,eAAS;AACT,YAAM,UAAU,SAAS,OAAO;AAAA,IAClC;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/runtime",
-  "version": "2026.10.27",
+  "version": "2026.11.1-canary.3",
   "description": "Long-running process layer for CLEO — agent polling, SSE connections, heartbeat, key rotation",
   "type": "module",
   "main": "dist/index.js",
@@ -37,8 +37,8 @@
   },
   "dependencies": {
     "node-cron": "^4.2.1",
-    "@cleocode/contracts": "2026.10.27",
-    "@cleocode/core": "2026.10.27"
+    "@cleocode/contracts": "2026.11.1-canary.3",
+    "@cleocode/core": "2026.11.1-canary.3"
   },
   "devDependencies": {
     "tsup": "^8.0.0",