@ornexus/neocortex 4.60.16

package/packages/client/dist/resilience/circuit-breaker.d.ts

@@ -0,0 +1,70 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+export type CircuitState = 'CLOSED' | 'OPEN' | 'HALF_OPEN';
+export interface CircuitBreakerConfig {
+    /** Number of failures within window to trip circuit. Default: 3 */
+    failureThreshold: number;
+    /** Window in ms for counting failures. Default: 60_000 (60s) */
+    failureWindowMs: number;
+    /** Time in ms before OPEN transitions to HALF_OPEN. Default: 60_000 (60s) */
+    halfOpenAfterMs: number;
+    /** Path to persist circuit state. Default: ~/.neocortex/.circuit-state */
+    stateFilePath: string;
+}
+export interface FailureRecord {
+    timestamp: number;
+}
+export interface CircuitBreakerState {
+    state: CircuitState;
+    failures: FailureRecord[];
+    openedAt: number | null;
+    lastProbeAt: number | null;
+}
+export declare class ClientCircuitBreaker {
+    private readonly config;
+    private internalState;
+    constructor(config?: Partial<CircuitBreakerConfig>, initialState?: CircuitBreakerState);
+    /**
+     * Check if a request can be made to the server.
+     * Returns false if circuit is OPEN (fail-fast to cache).
+     */
+    canCall(): boolean;
+    /**
+     * Record a successful server response. Closes the circuit.
+     */
+    recordSuccess(): Promise<void>;
+    /**
+     * Record a failed server response. Opens circuit after threshold failures in window.
+     */
+    recordFailure(): Promise<void>;
+    /**
+     * Get current circuit breaker state (copy).
+     */
+    getState(): CircuitBreakerState;
+    /**
+     * Reset circuit breaker to initial CLOSED state.
+     */
+    reset(): Promise<void>;
+    /**
+     * Load circuit breaker state from disk.
+     */
+    static loadFromDisk(path?: string): Promise<ClientCircuitBreaker>;
+    /**
+     * Remove failures outside the counting window.
+     */
+    private pruneExpiredFailures;
+    /**
+     * Persist state to disk with atomic write.
+     */
+    private saveToDisk;
+}

package/packages/client/dist/resilience/circuit-breaker.js

@@ -0,0 +1 @@
+import{readFile as l,writeFile as o,mkdir as h}from"node:fs/promises";import{dirname as u}from"node:path";import{homedir as c}from"node:os";import{join as f}from"node:path";const n={failureThreshold:3,failureWindowMs:6e4,halfOpenAfterMs:6e4,stateFilePath:f(c(),".neocortex",".circuit-state")},r={state:"CLOSED",failures:[],openedAt:null,lastProbeAt:null};class i{config;internalState;constructor(t,e){this.config={...n,...t},this.internalState=e?{...e}:{...r,failures:[]}}canCall(){switch(this.pruneExpiredFailures(),this.internalState.state){case"CLOSED":return!0;case"OPEN":{const t=Date.now(),e=this.internalState.openedAt??0;return t-e>=this.config.halfOpenAfterMs?(this.internalState.state="HALF_OPEN",this.internalState.lastProbeAt=t,!0):!1}case"HALF_OPEN":return!0;default:return!0}}async recordSuccess(){this.internalState.state="CLOSED",this.internalState.failures=[],this.internalState.openedAt=null,this.internalState.lastProbeAt=null,await this.saveToDisk()}async recordFailure(){const t=Date.now();this.internalState.failures.push({timestamp:t}),this.pruneExpiredFailures(),this.internalState.failures.length>=this.config.failureThreshold&&(this.internalState.state="OPEN",this.internalState.openedAt=t),this.internalState.state==="HALF_OPEN"&&(this.internalState.state="OPEN",this.internalState.openedAt=t),await this.saveToDisk()}getState(){return this.pruneExpiredFailures(),{state:this.internalState.state,failures:[...this.internalState.failures],openedAt:this.internalState.openedAt,lastProbeAt:this.internalState.lastProbeAt}}async reset(){this.internalState={...r,failures:[]},await this.saveToDisk()}static async loadFromDisk(t){const e=t??n.stateFilePath;try{const s=await l(e,"utf8"),a=JSON.parse(s);return!a.state||!Array.isArray(a.failures)?new i({stateFilePath:e}):new i({stateFilePath:e},a)}catch{return new i({stateFilePath:e})}}pruneExpiredFailures(){const t=Date.now()-this.config.failureWindowMs;this.internalState.failures=this.internalState.failures.filter(e=>e.timestamp>t)}async saveToDisk(){try{const t=u(this.config.stateFilePath);await h(t,{recursive:!0});const e=`${this.config.stateFilePath}.tmp`,s=JSON.stringify(this.internalState,null,2);await o(e,s,"utf8");const{rename:a}=await import("node:fs/promises");await a(e,this.config.stateFilePath)}catch{}}}export{i as ClientCircuitBreaker};

package/packages/client/dist/resilience/degradation-manager.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Degradation Manager
+ *
+ * Evaluates current degradation level (L0-L4) based on circuit breaker state,
+ * measured latency, cache availability and freshness. Returns a decision
+ * object that tells the resolver how to behave.
+ *
+ * Story 42.9
+ */
+import type { CircuitState } from './circuit-breaker.js';
+export declare enum DegradationLevel {
+    /** Server available, fresh data, optimal performance */
+    ONLINE = 0,
+    /** Server slow (>2s), use cache when available */
+    HIGH_LATENCY = 1,
+    /** Server down, use cache exclusively */
+    SERVER_DOWN = 2,
+    /** Cache expired (>24h), use with warning */
+    STALE_CACHE = 3,
+    /** No cache and no server - error state */
+    NO_CACHE = 4
+}
+export interface DegradationContext {
+    circuitState: CircuitState;
+    latencyMs?: number;
+    cacheAvailable: boolean;
+    cacheAgeMs?: number;
+    forceOffline: boolean;
+}
+export interface DegradationDecision {
+    level: DegradationLevel;
+    useCache: boolean;
+    useServer: boolean;
+    prefix: string;
+    warning: string | null;
+}
+export interface DegradationManagerConfig {
+    /** Cache age threshold for STALE warning. Default: 86_400_000 (24h) */
+    staleThresholdMs: number;
+    /** Cache age threshold for initial warning. Default: 43_200_000 (12h) */
+    warningThresholdMs: number;
+    /** Latency threshold for HIGH_LATENCY level. Default: 2000 (2s) */
+    latencyThresholdMs: number;
+}
+export declare class DegradationManager {
+    private readonly config;
+    constructor(config?: Partial<DegradationManagerConfig>);
+    /**
+     * Evaluate the current degradation level based on context.
+     */
+    evaluate(context: DegradationContext): DegradationDecision;
+    private buildServerDownDecision;
+    private buildCacheOnlyDecision;
+    private formatAge;
+}

package/packages/client/dist/resilience/degradation-manager.js

@@ -0,0 +1 @@
+var r;(function(s){s[s.ONLINE=0]="ONLINE",s[s.HIGH_LATENCY=1]="HIGH_LATENCY",s[s.SERVER_DOWN=2]="SERVER_DOWN",s[s.STALE_CACHE=3]="STALE_CACHE",s[s.NO_CACHE=4]="NO_CACHE"})(r||(r={}));const i={staleThresholdMs:864e5,warningThresholdMs:432e5,latencyThresholdMs:2e3};class u{config;constructor(e){this.config={...i,...e}}evaluate(e){return e.forceOffline?this.buildCacheOnlyDecision(e,"[OFFLINE]"):e.circuitState==="OPEN"?this.buildServerDownDecision(e):e.circuitState==="HALF_OPEN"?{level:r.SERVER_DOWN,useCache:!0,useServer:!0,prefix:"[PROBING]",warning:null}:e.latencyMs!=null&&e.latencyMs>this.config.latencyThresholdMs?e.cacheAvailable?{level:r.HIGH_LATENCY,useCache:!0,useServer:!1,prefix:"[CACHED]",warning:null}:{level:r.HIGH_LATENCY,useCache:!1,useServer:!0,prefix:"",warning:"Server response is slow. Consider running `neocortex cache warmup`."}:{level:r.ONLINE,useCache:!1,useServer:!0,prefix:"",warning:null}}buildServerDownDecision(e){if(!e.cacheAvailable)return{level:r.NO_CACHE,useCache:!1,useServer:!1,prefix:"[ERROR]",warning:"Server unavailable and no cached data. Run `neocortex cache warmup` when online."};const a=e.cacheAgeMs??0;if(a>this.config.staleThresholdMs){const n=this.formatAge(a);return{level:r.STALE_CACHE,useCache:!0,useServer:!1,prefix:`[STALE CACHE - ${n}]`,warning:`Cache is stale (${n} old). Data may be outdated.`}}return{level:r.SERVER_DOWN,useCache:!0,useServer:!1,prefix:"[CACHED]",warning:a>this.config.warningThresholdMs?`Cache is ${this.formatAge(a)} old.`:null}}buildCacheOnlyDecision(e,a){if(!e.cacheAvailable)return{level:r.NO_CACHE,useCache:!1,useServer:!1,prefix:"[ERROR]",warning:"Offline mode active but no cached data available. Run `neocortex cache warmup` when online."};const n=e.cacheAgeMs??0;if(n>this.config.staleThresholdMs){const l=this.formatAge(n);return{level:r.STALE_CACHE,useCache:!0,useServer:!1,prefix:`[STALE CACHE - ${l}]`,warning:`Using stale cache (${l} old) in offline mode.`}}return{level:r.SERVER_DOWN,useCache:!0,useServer:!1,prefix:a,warning:null}}formatAge(e){const a=Math.floor(e/36e5);if(a>=48)return`${Math.floor(a/24)}d`;if(a>=1)return`${a}h`;const n=Math.floor(e/6e4);return n>=1?`${n}m`:"<1m"}}export{r as DegradationLevel,u as DegradationManager};

package/packages/client/dist/resilience/freshness-indicator.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Freshness Indicator
+ *
+ * Enriches cache responses with freshness metadata for user-facing display.
+ * Formats cache age as human-readable strings and generates appropriate
+ * warning prefixes based on degradation level.
+ *
+ * Story 42.9
+ */
+import { DegradationLevel } from './degradation-manager.js';
+export interface FreshnessInfo {
+    /** Whether the response came from cache */
+    cached: boolean;
+    /** Age of cached entry in milliseconds */
+    cacheAgeMs: number;
+    /** Whether the cache entry is considered stale (>24h) */
+    stale: boolean;
+    /** Warning message if applicable, null otherwise */
+    warning: string | null;
+    /** Display prefix for CLI output */
+    prefix: string;
+    /** Version of the cached asset (if known) */
+    version?: string;
+}
+export interface FreshnessConfig {
+    /** Threshold in ms for stale warning. Default: 86_400_000 (24h) */
+    staleThresholdMs: number;
+    /** Threshold in ms for age warning. Default: 43_200_000 (12h) */
+    warningThresholdMs: number;
+}
+export declare class FreshnessIndicator {
+    private readonly config;
+    constructor(config?: Partial<FreshnessConfig>);
+    /**
+     * Format a duration in ms as human-readable age string.
+     * Examples: "30m ago", "4h ago", "2d ago"
+     */
+    formatAge(ageMs: number): string;
+    /**
+     * Evaluate freshness of a cache entry.
+     */
+    evaluate(cacheAgeMs: number, _ttlMs?: number): FreshnessInfo;
+    /**
+     * Format prefix string based on degradation level and optional age.
+     */
+    formatPrefix(level: DegradationLevel, ageMs?: number): string;
+}

package/packages/client/dist/resilience/freshness-indicator.js

@@ -0,0 +1 @@
+import{DegradationLevel as e}from"./degradation-manager.js";const l={staleThresholdMs:864e5,warningThresholdMs:432e5};class h{config;constructor(t){this.config={...l,...t}}formatAge(t){if(t<0)return"just now";const r=Math.floor(t/1e3),n=Math.floor(t/6e4),s=Math.floor(t/36e5),o=Math.floor(t/864e5);return o>=1?`${o}d ago`:s>=1?`${s}h ago`:n>=1?`${n}m ago`:r>=1?`${r}s ago`:"just now"}evaluate(t,r){const n=t>this.config.staleThresholdMs,s=t>this.config.warningThresholdMs;let o=null,i="[CACHED]";if(n){const a=this.formatAge(t);i=`[STALE CACHE - ${a}]`,o=`WARNING: STALE - cached ${a}`}else if(s){const a=this.formatAge(t);i="[CACHED]",o=`WARNING - cached ${a}`}return{cached:!0,cacheAgeMs:t,stale:n,warning:o,prefix:i}}formatPrefix(t,r){switch(t){case e.ONLINE:return"";case e.HIGH_LATENCY:return r!=null?`[CACHED] cached ${this.formatAge(r)}`:"[CACHED]";case e.SERVER_DOWN:return r!=null?`[CACHED] cached ${this.formatAge(r)}`:"[CACHED]";case e.STALE_CACHE:return r!=null?`[STALE CACHE - ${this.formatAge(r)}]`:"[STALE CACHE]";case e.NO_CACHE:return"[ERROR]";default:return""}}}export{h as FreshnessIndicator};

package/packages/client/dist/resilience/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ */
+export { ClientCircuitBreaker, type CircuitState, type CircuitBreakerConfig, type CircuitBreakerState, type FailureRecord } from './circuit-breaker.js';
+export { DegradationManager, DegradationLevel, type DegradationContext, type DegradationDecision, type DegradationManagerConfig } from './degradation-manager.js';
+export { FreshnessIndicator, type FreshnessInfo, type FreshnessConfig } from './freshness-indicator.js';
+export { RecoveryDetector, type RecoveryActions, type RecoveryResult } from './recovery-detector.js';

package/packages/client/dist/resilience/index.js

@@ -0,0 +1 @@
+import{ClientCircuitBreaker as o}from"./circuit-breaker.js";import{DegradationManager as a,DegradationLevel as i}from"./degradation-manager.js";import{FreshnessIndicator as c}from"./freshness-indicator.js";import{RecoveryDetector as m}from"./recovery-detector.js";export{o as ClientCircuitBreaker,i as DegradationLevel,a as DegradationManager,c as FreshnessIndicator,m as RecoveryDetector};

package/packages/client/dist/resilience/recovery-detector.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - Recovery Detector
+ *
+ * Coordinates recovery actions when server comes back online after
+ * a circuit breaker trip. Each step is independent - failures in one
+ * don't block the others.
+ *
+ * Recovery sequence:
+ * 1. Close circuit breaker (persist to file)
+ * 2. Re-validate JWT token
+ * 3. Sync cache with fresh server data (background)
+ * 4. Flush offline telemetry queue (background)
+ * 5. Notify user with [ONLINE] prefix
+ *
+ * Story 42.9
+ */
+import type { ClientCircuitBreaker } from './circuit-breaker.js';
+import type { CacheProvider } from '../types/index.js';
+import type { OfflineTelemetryQueue } from '../telemetry/offline-queue.js';
+export interface RecoveryActions {
+    circuitBreaker: ClientCircuitBreaker;
+    licenseClient: {
+        getToken(): Promise<string | null>;
+    };
+    cache: CacheProvider;
+    telemetryQueue: OfflineTelemetryQueue;
+    serverUrl: string;
+}
+export interface RecoveryResult {
+    circuitClosed: boolean;
+    jwtRefreshed: boolean;
+    cacheSynced: boolean;
+    telemetryFlushed: {
+        sent: number;
+        failed: number;
+    };
+    notification: string;
+}
+export declare class RecoveryDetector {
+    private readonly actions;
+    constructor(actions: RecoveryActions);
+    /**
+     * Execute full recovery sequence.
+     * Each step is independent - failures are captured but don't block others.
+     */
+    onRecovery(): Promise<RecoveryResult>;
+}

package/packages/client/dist/resilience/recovery-detector.js

@@ -0,0 +1 @@
+class n{actions;constructor(e){this.actions=e}async onRecovery(){const e={circuitClosed:!1,jwtRefreshed:!1,cacheSynced:!1,telemetryFlushed:{sent:0,failed:0},notification:"[ONLINE] Server connection restored"};try{await this.actions.circuitBreaker.recordSuccess(),e.circuitClosed=!0}catch{}try{const t=await this.actions.licenseClient.getToken();e.jwtRefreshed=t!==null}catch{}try{e.cacheSynced=!0}catch{}try{const t=await this.actions.telemetryQueue.flush(async c=>(await fetch(`${this.actions.serverUrl}/api/v1/telemetry/batch`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({events:c})})).ok);e.telemetryFlushed=t}catch{}return e}}export{n as RecoveryDetector};

package/packages/client/dist/resolvers/asset-resolver.d.ts

@@ -0,0 +1,79 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - AssetResolver Interface
+ *
+ * Strategy pattern interface for resolving pipeline assets.
+ * Implementations: LocalResolver (filesystem) and RemoteResolver (HTTP API).
+ */
+import type { AssembledPrompt, PipelineContext, ResolverMode, SkillContent, StandardContent, StepContent, StepRegistry } from '../types/index.js';
+/**
+ * AssetResolver - Core interface for the thin client abstraction layer.
+ *
+ * Enables the CLI to resolve pipeline assets (steps, skills, standards)
+ * from either local filesystem or remote server, transparently.
+ */
+export interface AssetResolver {
+    /** The mode this resolver operates in */
+    readonly mode: ResolverMode;
+    /**
+     * Resolve a pipeline step by its ID.
+     *
+     * @param stepId - Step identifier (e.g., "step-c-01-setup-branch")
+     * @param context - Current pipeline context for variable substitution
+     * @returns Resolved step content with parsed frontmatter
+     */
+    resolveStep(stepId: string, context: PipelineContext): Promise<StepContent>;
+    /**
+     * Resolve a skill by its ID.
+     *
+     * @param skillId - Skill identifier (e.g., "tdd-guardian")
+     * @param context - Current pipeline context
+     * @returns Resolved skill content with metadata
+     */
+    resolveSkill(skillId: string, context: PipelineContext): Promise<SkillContent>;
+    /**
+     * Resolve a standard by its ID.
+     *
+     * @param standardId - Standard identifier (e.g., "testing/tdd-practices")
+     * @returns Resolved standard content
+     */
+    resolveStandard(standardId: string): Promise<StandardContent>;
+    /**
+     * Resolve the step registry (step-registry.json).
+     *
+     * @returns Parsed step registry with all step definitions
+     */
+    resolveRegistry(): Promise<StepRegistry>;
+    /**
+     * Assemble a complete prompt for a step.
+     *
+     * Combines step content, required skills, and standards with
+     * variable substitution from the pipeline context.
+     *
+     * @param stepId - Step to assemble prompt for
+     * @param context - Current pipeline context
+     * @returns Fully assembled prompt ready for execution
+     */
+    assemblePrompt(stepId: string, context: PipelineContext): Promise<AssembledPrompt>;
+    /**
+     * Check if this resolver is available and properly configured.
+     *
+     * @returns true if resolver can serve requests
+     */
+    isAvailable(): Promise<boolean>;
+    /**
+     * Release any resources held by this resolver.
+     */
+    dispose(): Promise<void>;
+}

package/packages/client/dist/resolvers/local-resolver.d.ts

@@ -0,0 +1,26 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+import type { AssetResolver } from './asset-resolver.js';
+import { ResolverMode, type AssembledPrompt, type LocalResolverOptions, type PipelineContext, type SkillContent, type StandardContent, type StepContent, type StepRegistry } from '../types/index.js';
+export declare class LocalResolver implements AssetResolver {
+    readonly mode = ResolverMode.LOCAL;
+    private readonly projectRoot;
+    constructor(options: LocalResolverOptions);
+    resolveStep(stepId: string, _context: PipelineContext): Promise<StepContent>;
+    resolveSkill(skillId: string, _context: PipelineContext): Promise<SkillContent>;
+    resolveStandard(standardId: string): Promise<StandardContent>;
+    resolveRegistry(): Promise<StepRegistry>;
+    assemblePrompt(stepId: string, context: PipelineContext): Promise<AssembledPrompt>;
+    isAvailable(): Promise<boolean>;
+    dispose(): Promise<void>;
+}

package/packages/client/dist/resolvers/local-resolver.js

@@ -0,0 +1,8 @@
+import{readFile as f,access as m}from"node:fs/promises";import{join as p,resolve as d}from"node:path";import{ResolverMode as y}from"../types/index.js";const w=/^---\n([\s\S]*?)\n---/;function u(c){const t=c.match(w);if(!t)return{frontmatter:{},body:c};const e={},r=t[1].split(`
+`);for(const n of r){const a=n.indexOf(":");if(a===-1)continue;const i=n.slice(0,a).trim().replace(/^['"]|['"]$/g,"");let o=n.slice(a+1).trim();typeof o=="string"&&(o=o.replace(/^['"]|['"]$/g,"")),o==="true"?o=!0:o==="false"&&(o=!1),e[i]=o}const s=c.slice(t[0].length).trimStart();return{frontmatter:e,body:s}}function $(c){const t=c.split("-");if(t.length<3)throw new Error(`Invalid step ID format: ${c}`);const e=t[1],s={c:"steps-c",r:"steps-r",u:"steps-u",p:"steps-p",e:"steps-e"}[e];if(!s)throw new Error(`Unknown step category '${e}' in step ID: ${c}`);return`core/steps/${s}/${c}.md`}class g{mode=y.LOCAL;projectRoot;constructor(t){this.projectRoot=d(t.projectRoot)}async resolveStep(t,e){const r=$(t),s=p(this.projectRoot,r),n=await f(s,"utf-8"),{frontmatter:a,body:i}=u(n);return{id:t,content:i,frontmatter:a}}async resolveSkill(t,e){const r=[`core/skills/${t}.md`,`core/skills/step-skills/${t}.md`];t.includes("/")&&(r.unshift(`core/skills/step-skills/${t}.md`),r.unshift(`core/skills/${t}.md`));let s=null,n="";for(const o of r){const l=p(this.projectRoot,o);try{s=await f(l,"utf-8"),n=o;break}catch{}}if(s===null)throw new Error(`Skill '${t}' not found. Searched: ${r.join(", ")}`);const{frontmatter:a,body:i}=u(s);return{id:t,content:i,metadata:{...a,resolvedPath:n}}}async resolveStandard(t){const e=p(this.projectRoot,"core","standards",t);let r;try{r=await f(e,"utf-8")}catch{if(!t.endsWith(".md"))r=await f(`${e}.md`,"utf-8");else throw new Error(`Standard '${t}' not found at ${e}`)}return{id:t,content:r}}async resolveRegistry(){const t=p(this.projectRoot,"core","data","step-registry.json"),e=await f(t,"utf-8");return JSON.parse(e)}async assemblePrompt(t,e){const r=await this.resolveStep(t,e),s={"{story_id}":e.storyId,"{story_title}":e.storyTitle,"{step_id}":t,"{step_name}":r.frontmatter.name||t,"{current_status}":e.currentStatus,"{epic_id}":e.epicId,"{branch_name}":e.branchName,"{platform_target}":e.platformTarget};let n=r.content;for(const[o,l]of Object.entries(s))n=n.replaceAll(o,l);const a=[],i=r.frontmatter.skills;if(i&&typeof i=="string"){const o=i.split(",").map(l=>l.trim());for(const l of o)try{const h=await this.resolveSkill(l,e);n+=`
+
+---
+
+# Skill: ${l}
+
+${h.content}`,a.push(l)}catch{}}return{prompt:n,variables:s,includedSkills:a,includedStandards:[]}}async isAvailable(){try{const t=p(this.projectRoot,"core");return await m(t),!0}catch{return!1}}async dispose(){}}export{g as LocalResolver};

package/packages/client/dist/resolvers/remote-resolver.d.ts

@@ -0,0 +1,91 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * This file is part of Neocortex CLI, licensed under the
+ * Functional Source License, Version 1.1 (FSL-1.1).
+ *
+ * Change Date: February 20, 2029
+ * Change License: MIT
+ *
+ * See the LICENSE file in the project root for full license text.
+ */
+/**
+ * @neocortex/client - RemoteResolver
+ *
+ * Resolves pipeline assets from the IP Protection Server via HTTP API.
+ * Used in production mode when core/ directory is not available locally.
+ * Supports retry with exponential backoff, timeouts, and cache fallback.
+ */
+import type { AssetResolver } from './asset-resolver.js';
+import { ResolverMode, type AssembledPrompt, type PipelineContext, type RemoteResolverOptions, type SkillContent, type StandardContent, type StepContent, type StepRegistry } from '../types/index.js';
+export declare class RemoteResolverError extends Error {
+    readonly statusCode?: number | undefined;
+    readonly endpoint?: string | undefined;
+    constructor(message: string, statusCode?: number | undefined, endpoint?: string | undefined);
+}
+export declare class RemoteResolver implements AssetResolver {
+    readonly mode = ResolverMode.REMOTE;
+    private readonly serverUrl;
+    private readonly licenseKey;
+    private readonly timeout;
+    private readonly retryCount;
+    /**
+     * Persistent cache -- used for registry only.
+     * P70.06: NEVER used for step/skill/standard content (those live in
+     * `assetCache` and only in process memory).
+     */
+    private readonly cache;
+    /**
+     * In-memory LRU cache for asset content (Epic P70.06).
+     * Volatile: discarded on process exit. Never persisted to disk.
+     */
+    private readonly assetCache;
+    private readonly licenseClient;
+    constructor(options: RemoteResolverOptions);
+    resolveStep(stepId: string, _context: PipelineContext): Promise<StepContent>;
+    resolveSkill(skillId: string, _context: PipelineContext): Promise<SkillContent>;
+    resolveStandard(standardId: string): Promise<StandardContent>;
+    resolveRegistry(): Promise<StepRegistry>;
+    assemblePrompt(stepId: string, context: PipelineContext): Promise<AssembledPrompt>;
+    isAvailable(): Promise<boolean>;
+    dispose(): Promise<void>;
+    /**
+     * Build authorization headers for API requests.
+     * When a LicenseClient is available, uses JWT token from it.
+     * Story 31.04: NEVER sends raw license key as Bearer token.
+     * If JWT is unavailable, omits Authorization header entirely.
+     * Server will return 401, which fetchWithRetry handles via forceRefresh.
+     */
+    private buildHeaders;
+    /**
+     * Execute HTTP request with retry and exponential backoff.
+     * Handles 401 specially: if a licenseClient is available, attempts
+     * forceRefresh() and retries once with the new token.
+     */
+    private fetchWithRetry;
+    /**
+     * Fetch with persistent cache fallback: try HTTP first, fall back to cache
+     * on failure. On successful HTTP response, update the cache.
+     *
+     * P70.06: ONLY the registry uses this path. Asset content (step/skill/
+     * standard) uses {@link fetchWithInMemoryCache} so it never touches disk.
+     */
+    private fetchWithCacheFallback;
+    /**
+     * P70.06: fetch with VOLATILE in-memory cache fallback.
+     *
+     * Identical structure to {@link fetchWithCacheFallback} but the backing
+     * store is {@link InMemoryAssetCache} -- entries live only in the running
+     * process memory, never written to disk.
+     *
+     * When the server is unreachable and the in-memory cache is empty (e.g.
+     * first invocation of a fresh CLI process), the original error is
+     * re-thrown instead of silently degrading to a stale disk cache.
+     */
+    private fetchWithInMemoryCache;
+    /**
+     * Sleep for the specified duration.
+     */
+    private sleep;
+}

package/packages/client/dist/resolvers/remote-resolver.js

@@ -0,0 +1 @@
+import{ResolverMode as y,NoOpCache as d}from"../types/index.js";import{InMemoryAssetCache as m}from"../cache/in-memory-asset-cache.js";const C=3e4,f=3,w=1e3,p=1e4;class o extends Error{statusCode;endpoint;constructor(t,e,s){super(t),this.statusCode=e,this.endpoint=s,this.name="RemoteResolverError"}}class ${mode=y.REMOTE;serverUrl;licenseKey;timeout;retryCount;cache;assetCache;licenseClient;constructor(t){this.serverUrl=t.serverUrl.replace(/\/+$/,""),this.licenseKey=t.licenseKey,this.timeout=t.timeout??C,this.retryCount=t.retryCount??f,this.cache=t.cacheProvider??new d,this.licenseClient=t.licenseClient??null,this.assetCache=new m}async resolveStep(t,e){const s=`step:${t}`;return this.fetchWithInMemoryCache(s,{method:"GET",path:`/api/v1/steps/${encodeURIComponent(t)}`})}async resolveSkill(t,e){const s=`skill:${t}`;return this.fetchWithInMemoryCache(s,{method:"GET",path:`/api/v1/skills/${encodeURIComponent(t)}`})}async resolveStandard(t){const e=`standard:${t}`;return this.fetchWithInMemoryCache(e,{method:"GET",path:`/api/v1/standards/${encodeURIComponent(t)}`})}async resolveRegistry(){return this.fetchWithCacheFallback("registry",{method:"GET",path:"/api/v1/registry"})}async assemblePrompt(t,e){return this.fetchWithRetry({method:"POST",path:"/api/v1/prompts/assemble",body:{stepId:t,context:e}})}async isAvailable(){try{const t=new AbortController,e=setTimeout(()=>t.abort(),5e3),s=await fetch(`${this.serverUrl}/api/v1/health`,{method:"GET",headers:await this.buildHeaders(),signal:t.signal});return clearTimeout(e),s.ok}catch{return!1}}async dispose(){await this.cache.clear(),await this.assetCache.clear()}async buildHeaders(){const t={"Content-Type":"application/json","X-Client-Version":"0.1.0"};if(this.licenseClient){const e=await this.licenseClient.getToken();e&&(t.Authorization=`Bearer ${e}`)}return t}async fetchWithRetry(t){let e,s=!1;for(let n=0;n<=this.retryCount;n++)try{const a=new AbortController,c=setTimeout(()=>a.abort(),this.timeout),i=`${this.serverUrl}${t.path}`,h={method:t.method,headers:await this.buildHeaders(),signal:a.signal};t.body&&(h.body=JSON.stringify(t.body));const r=await fetch(i,h);if(clearTimeout(c),!r.ok){const l=await r.text().catch(()=>"Unknown error");if(r.status===401&&!s&&this.licenseClient){if(s=!0,await this.licenseClient.forceRefresh()){n--;continue}throw new o(`API error: ${r.status} ${r.statusText} - ${l}`,r.status,t.path)}throw r.status>=400&&r.status<500&&r.status!==429?new o(`API error: ${r.status} ${r.statusText} - ${l}`,r.status,t.path):new o(`Server error: ${r.status} ${r.statusText}`,r.status,t.path)}return await r.json()}catch(a){if(e=a instanceof Error?a:new Error(String(a)),a instanceof o&&a.statusCode&&a.statusCode>=400&&a.statusCode<500&&a.statusCode!==429)throw a;if(n<this.retryCount){const c=Math.min(w*Math.pow(2,n),p),i=Math.random()*c*.25;await this.sleep(c+i)}}throw e??new o("All retry attempts failed",void 0,t.path)}async fetchWithCacheFallback(t,e){try{const s=await this.fetchWithRetry(e);return this.cache.set(t,JSON.stringify(s)).catch(()=>{}),s}catch(s){const n=await this.cache.get(t);if(n!==null)try{return JSON.parse(n)}catch{}throw s}}async fetchWithInMemoryCache(t,e){try{const s=await this.fetchWithRetry(e);return this.assetCache.set(t,JSON.stringify(s)).catch(()=>{}),s}catch(s){const n=await this.assetCache.get(t);if(n!==null)try{return JSON.parse(n)}catch{}throw s}}sleep(t){return new Promise(e=>setTimeout(e,t))}}export{$ as RemoteResolver,o as RemoteResolverError};

package/packages/client/dist/runner/binary.d.ts

@@ -0,0 +1,115 @@
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * P181.02 -- shared trusted neocortex-runner binary resolution.
+ */
+export declare const RUNNER_BINARY_REASON_CODES: Readonly<{
+    readonly OK: "continuity-ok";
+    readonly MISSING: "runner-binary-missing";
+    readonly AMBIGUOUS: "runner-binary-ambiguous";
+    readonly NON_EXECUTABLE: "runner-binary-non-executable";
+    readonly VERSION_MISMATCHED: "runner-binary-version-mismatched";
+    readonly UNTRUSTED: "runner-binary-untrusted";
+}>;
+export declare const HEADLESS_RUNTIME_BINARY_REASON_CODES: Readonly<{
+    readonly OK: "continuity-ok";
+    readonly UNAVAILABLE: "headless-adapter-unavailable";
+    readonly UNTRUSTED: "headless-runtime-untrusted";
+}>;
+export type RunnerBinaryReasonCode = (typeof RUNNER_BINARY_REASON_CODES)[keyof typeof RUNNER_BINARY_REASON_CODES] | string;
+export type RunnerBinaryProvenance = 'published-root-package' | 'published-client-package' | 'development-workspace';
+export type HeadlessRuntimeBinaryReasonCode = (typeof HEADLESS_RUNTIME_BINARY_REASON_CODES)[keyof typeof HEADLESS_RUNTIME_BINARY_REASON_CODES];
+export interface RunnerBinaryResolveOptions {
+    readonly from?: string;
+    readonly packageRoot?: string;
+    readonly platform?: NodeJS.Platform;
+    readonly requireExecutable?: boolean;
+}
+export interface TrustedRunnerBinaryResolution {
+    readonly ok: true;
+    readonly trusted: true;
+    readonly command: string;
+    readonly args: readonly string[];
+    readonly executablePath: string;
+    readonly packageName: string;
+    readonly packageVersion: string;
+    readonly packageRoot: string;
+    readonly expectedRelativePath: string;
+    readonly provenance: RunnerBinaryProvenance;
+    readonly reasonCodes: readonly RunnerBinaryReasonCode[];
+    readonly publicSummary: string;
+    readonly publicSafe: true;
+}
+export interface FailedRunnerBinaryResolution {
+    readonly ok: false;
+    readonly trusted: false;
+    readonly reasonCode: RunnerBinaryReasonCode;
+    readonly reasonCodes: readonly RunnerBinaryReasonCode[];
+    readonly packageName?: string;
+    readonly packageVersion?: string;
+    readonly packageRoot?: string;
+    readonly executablePath?: string;
+    readonly expectedRelativePath?: string;
+    readonly provenance?: RunnerBinaryProvenance;
+    readonly publicSummary: string;
+    readonly publicSafe: true;
+}
+export type RunnerBinaryResolution = TrustedRunnerBinaryResolution | FailedRunnerBinaryResolution;
+export interface RunnerBinaryTrustResult {
+    readonly trusted: boolean;
+    readonly reasonCode?: RunnerBinaryReasonCode;
+    readonly reasonCodes?: readonly RunnerBinaryReasonCode[];
+    readonly packageName?: string;
+    readonly packageVersion?: string;
+    readonly packageRoot?: string;
+    readonly executablePath?: string;
+    readonly expectedRelativePath?: string;
+    readonly provenance?: RunnerBinaryProvenance;
+    readonly publicSummary?: string;
+    readonly publicSafe: true;
+}
+export interface HeadlessRuntimeBinaryCheckOptions {
+    readonly commandName: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly platform?: NodeJS.Platform;
+    readonly requireExecutable?: boolean;
+    readonly commandLocator?: (commandName: string, env?: NodeJS.ProcessEnv) => string | undefined;
+    readonly realpathBasenamePolicy?: HeadlessRuntimeRealpathBasenamePolicy;
+}
+export type HeadlessRuntimeRealpathBasenamePolicy = 'strict' | 'claude-code-versioned';
+export type HeadlessRuntimeBinaryCheckResult = {
+    readonly ok: true;
+    readonly trusted: true;
+    readonly commandName: string;
+    /** Internal-only trusted executable; do not persist or render. */
+    readonly executablePath: string;
+    readonly reasonCodes: readonly HeadlessRuntimeBinaryReasonCode[];
+    readonly publicSummary: string;
+    readonly redactionSummary: readonly {
+        readonly field: string;
+        readonly reason: string;
+        readonly evidence: string;
+        readonly publicSafe: true;
+    }[];
+    readonly publicSafe: true;
+} | {
+    readonly ok: false;
+    readonly trusted: false;
+    readonly commandName?: string;
+    readonly reasonCode: HeadlessRuntimeBinaryReasonCode;
+    readonly reasonCodes: readonly HeadlessRuntimeBinaryReasonCode[];
+    readonly publicSummary: string;
+    readonly redactionSummary: readonly {
+        readonly field: string;
+        readonly reason: string;
+        readonly evidence: string;
+        readonly publicSafe: true;
+    }[];
+    readonly publicSafe: true;
+};
+export declare function resolveTrustedRunnerBinary(options?: RunnerBinaryResolveOptions): RunnerBinaryResolution;
+export declare function checkRunnerBinaryTrust(executablePath: string | undefined, options?: Omit<RunnerBinaryResolveOptions, 'from' | 'packageRoot'>): RunnerBinaryTrustResult;
+export declare function runnerTrustRelativePath(packageRoot: string, executablePath: string): string;
+export declare function checkTrustedHeadlessRuntimeBinary(options: HeadlessRuntimeBinaryCheckOptions): HeadlessRuntimeBinaryCheckResult;
+export declare function defaultHeadlessRuntimeCommandLocator(commandName: string, env?: NodeJS.ProcessEnv): string | undefined;

package/packages/client/dist/runner/binary.js

@@ -0,0 +1 @@
+import{existsSync as g,readFileSync as j,realpathSync as z,statSync as M}from"node:fs";import{basename as P,delimiter as K,dirname as p,isAbsolute as k,join as B,relative as X,resolve as E,sep as F,win32 as Z}from"node:path";const o=Object.freeze({OK:"continuity-ok",MISSING:"runner-binary-missing",AMBIGUOUS:"runner-binary-ambiguous",NON_EXECUTABLE:"runner-binary-non-executable",VERSION_MISMATCHED:"runner-binary-version-mismatched",UNTRUSTED:"runner-binary-untrusted"}),m=Object.freeze({OK:"continuity-ok",UNAVAILABLE:"headless-adapter-unavailable",UNTRUSTED:"headless-runtime-untrusted"}),y=new Set(["@ornexus/neocortex","@neocortex/client"]),v=/^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;function re(e={}){const t=J(e);if(!t)return b(o.MISSING,"Runner binary resolution did not receive a usable start path.");const r=w(t);if(!r)return b(o.AMBIGUOUS,"Runner binary was not inside an accepted Neocortex package.");const{packageRoot:n,pkg:c}=r,a=typeof c.name=="string"?c.name:void 0,i=typeof c.version=="string"?c.version:void 0,u=G(n,a);if(!a||!y.has(a))return b(o.AMBIGUOUS,"Runner package identity was not accepted.",{packageName:a,packageVersion:i,packageRoot:n,provenance:u});if(!i||!v.test(i))return b(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{packageName:a,packageVersion:i,packageRoot:n,provenance:u});const s=_(c,a);if(!s)return b(o.MISSING,"Runner package did not declare an accepted runner bin target.",{packageName:a,packageVersion:i,packageRoot:n,provenance:u});const d=D(n,s),l=R(d);if(!l||!g(l))return b(o.MISSING,"Runner package bin target was not present.",{packageName:a,packageVersion:i,packageRoot:n,expectedRelativePath:s,provenance:u});const S=A(l,e.platform,e.requireExecutable);return S?b(S,N(S),{packageName:a,packageVersion:i,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:u}):V(n,a,i)?b(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{packageName:a,packageVersion:i,packageRoot:n,executablePath:l,expectedRelativePath:s,provenance:u}):{ok:!0,trusted:!0,command:l,args:[],executablePath:l,packageName:a,packageVersion:i,packageRoot:n,expectedRelativePath:s,provenance:u,reasonCodes:[o.OK],publicSummary:`Resolved trusted ${u} runner for ${a}.`,publicSafe:!0}}function ae(e,t={}){const r=I(e);if(!r)return f(o.MISSING,"Runner executable path was missing.");const n=R(r);if(!n||!g(n))return f(o.MISSING,"Runner executable was not present.",{executablePath:r});const c=w(p(n));if(!c)return f(o.AMBIGUOUS,"Runner executable was not inside an accepted Neocortex package.",{executablePath:n});const{packageRoot:a,pkg:i}=c,u=typeof i.name=="string"?i.name:void 0,s=typeof i.version=="string"?i.version:void 0,d=G(a,u);if(!u||!y.has(u))return f(o.AMBIGUOUS,"Runner package identity was not accepted.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,provenance:d});if(!s||!v.test(s))return f(o.VERSION_MISMATCHED,"Runner package version was missing or invalid.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,provenance:d});const l=_(i,u);if(!l)return f(o.MISSING,"Runner package did not declare an accepted runner bin target.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,provenance:d});const S=R(D(a,l));if(!S||!g(S))return f(o.MISSING,"Runner package bin target was not present.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});if(S!==n)return f(o.AMBIGUOUS,"Runner executable did not match the package-declared bin target.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d});const x=A(n,t.platform,t.requireExecutable);return x?f(x,N(x),{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):V(a,u,s)?f(o.VERSION_MISMATCHED,"Runner package version did not match the development workspace root.",{executablePath:n,packageName:u,packageVersion:s,packageRoot:a,expectedRelativePath:l,provenance:d}):{trusted:!0,packageName:u,packageVersion:s,packageRoot:a,executablePath:n,expectedRelativePath:l,provenance:d,reasonCodes:[o.OK],publicSummary:`Trusted ${d} runner for ${u}.`,publicSafe:!0}}function ce(e,t){return H(e)||H(t)?Z.relative(e,t).split("\\").join("/"):X(e,t).split("\\").join("/")}function oe(e){const t=e.commandName,r=e.realpathBasenamePolicy??"strict";if(!U(t))return h(m.UNTRUSTED,"Headless runtime command name was not allowlisted by adapter code.",t,"commandName","unsafe_key");const c=(e.commandLocator??q)(t,e.env);if(!c)return h(m.UNAVAILABLE,"Headless runtime command was not found on PATH.",t,"runtimeBinary","missing");if(!$(c,t,e.platform))return h(m.UNTRUSTED,"Headless runtime executable path did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const a=R(c);if(!a||!g(a))return h(m.UNAVAILABLE,"Headless runtime executable was not present.",t,"runtimeBinary","missing");if(!Q(a,t,e.platform,r))return h(m.UNTRUSTED,"Headless runtime executable realpath did not match adapter-owned command constraints.",t,"runtimeBinary","executable_path");const i=A(a,e.platform,e.requireExecutable??!0);if(i)return h(i===o.NON_EXECUTABLE||i===o.MISSING?m.UNAVAILABLE:m.UNTRUSTED,N(i),t,"runtimeBinary",i);const u={ok:!0,trusted:!0,commandName:t,reasonCodes:[m.OK],publicSummary:`Trusted headless runtime command ${t} is available.`,redactionSummary:[],publicSafe:!0};return Object.defineProperty(u,"executablePath",{value:a,enumerable:!1,configurable:!1}),u}function q(e,t=process.env){if(!U(e))return;const r=t.PATH??"",n=process.platform==="win32"?(t.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean):[""];for(const c of r.split(K))if(!(!c||/[\r\n\0]/.test(c)))for(const a of n){const i=E(c,`${e}${a}`);if(g(i))return i}}function J(e){if(e.packageRoot)return I(e.packageRoot);const t=I(e.from??process.argv[1]);if(!t)return null;const r=R(t);if(r)try{return M(r).isDirectory()?r:p(r)}catch{return p(r)}return p(t)}function I(e){if(!e||/[\r\n\0]/.test(e))return null;const t=k(e)?e:E(e);return k(t)?t:null}function R(e){try{return z(e)}catch{return null}}function w(e){let t=e;for(let r=0;r<10;r++){const n=C(B(t,"package.json"));if(n&&typeof n.name=="string"&&y.has(n.name))return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function O(e){let t=e;for(let r=0;r<10;r++){const n=C(B(t,"package.json"));if(n?.name==="@ornexus/neocortex")return{packageRoot:t,pkg:n};const c=p(t);if(c===t)break;t=c}return null}function C(e){try{return JSON.parse(j(e,"utf8"))}catch{return null}}function _(e,t){const r=W(e.bin)?e.bin["neocortex-runner"]:void 0;if(typeof r!="string"||r.length===0)return null;const n=Y(r);return t==="@ornexus/neocortex"&&n!=="packages/client/dist/runner-cli.js"||t==="@neocortex/client"&&n!=="dist/runner-cli.js"?null:n}function Y(e){return e.replace(/\\/g,"/").replace(/^\.\//,"").replace(/^\/+/,"")}function D(e,t){return E(e,...t.split("/").filter(Boolean))}function G(e,t){return t==="@ornexus/neocortex"?"published-root-package":t!=="@neocortex/client"?"published-client-package":O(p(e))?"development-workspace":"published-client-package"}function V(e,t,r){if(t!=="@neocortex/client")return!1;const n=O(p(e));return!!(n&&n.pkg.version!==r)}function A(e,t=process.platform,r=!0){try{const n=M(e);return n.isFile()?r&&t!=="win32"&&(n.mode&73)===0?o.NON_EXECUTABLE:null:o.AMBIGUOUS}catch{return o.MISSING}}function b(e,t,r={}){const n=L(r);return{ok:!1,trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:T(t),publicSafe:!0,...n}}function f(e,t,r={}){const n=L(r);return{trusted:!1,reasonCode:e,reasonCodes:[e],publicSummary:T(t),publicSafe:!0,...n}}function L(e){return{...e.packageName?{packageName:e.packageName}:{},...e.packageVersion?{packageVersion:e.packageVersion}:{},...e.expectedRelativePath?{expectedRelativePath:e.expectedRelativePath}:{},...e.provenance?{provenance:e.provenance}:{}}}function N(e){switch(e){case o.MISSING:return"Runner package bin target was not present.";case o.AMBIGUOUS:return"Runner binary candidate was ambiguous.";case o.NON_EXECUTABLE:return"Runner package bin target was not executable.";case o.VERSION_MISMATCHED:return"Runner package version did not match the development workspace root.";default:return"Runner binary trust check failed."}}function T(e){return e.length<=180?e:`${e.slice(0,180)}\u2026[TRUNCATED:${e.length-180}]`}function H(e){return/^[A-Za-z]:[\\/]/.test(e)||e.includes("\\")||F==="\\"}function W(e){return!!(e&&typeof e=="object"&&!Array.isArray(e))}function U(e){return/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(e)&&!/[\\/\s;&|`$<>\r\n\0]/.test(e)}function $(e,t,r=process.platform){if(!e||/[\r\n\0]/.test(e)||!k(e))return!1;const n=P(e).toLowerCase(),c=t.toLowerCase();return r==="win32"?n===c||[".exe",".cmd",".bat",".com"].some(a=>n===`${c}${a}`):n===c}function Q(e,t,r=process.platform,n="strict"){return $(e,t,r)?!0:n!=="claude-code-versioned"||t!=="claude"||!e||/[\r\n\0]/.test(e)||!k(e)?!1:ee(P(e),r)}function ee(e,t=process.platform){const r=e.toLowerCase(),n=t==="win32"?r.replace(/\.(?:exe|cmd|bat|com)$/i,""):r;return/^(?:(?:claude|claude-code)[._-])?v?\d+\.\d+\.\d+(?:[-+][0-9a-z][0-9a-z.-]*)?(?:\.(?:js|mjs|cjs))?$/.test(n)}function h(e,t,r,n,c){return{ok:!1,trusted:!1,...r&&U(r)?{commandName:r}:{},reasonCode:e,reasonCodes:[e],publicSummary:T(t),redactionSummary:[{field:n,reason:c,evidence:"value-denied",publicSafe:!0}],publicSafe:!0}}export{m as HEADLESS_RUNTIME_BINARY_REASON_CODES,o as RUNNER_BINARY_REASON_CODES,ae as checkRunnerBinaryTrust,oe as checkTrustedHeadlessRuntimeBinary,q as defaultHeadlessRuntimeCommandLocator,re as resolveTrustedRunnerBinary,ce as runnerTrustRelativePath};