@ornexus/neocortex 4.60.67 → 4.60.68

package/packages/client/dist/runner/portal-sync-worker.js

@@ -1 +1,1487 @@
-import{createHash as ve}from"node:crypto";import{resolve as ae}from"node:path";import{DEFAULT_SERVER_URL as $e}from"../constants.js";import{loadSecureConfig as se}from"../config/secure-config.js";import{LicenseClient as Ke}from"../license/license-client.js";import{CLIENT_VERSION as $}from"../version.js";import{deriveProjectIdentity as G}from"./project-identity.js";import{CONTINUITY_CLIENT_CONTRACT_VERSION as K,CONTINUITY_CLIENT_PORTAL_SYNC_ENVELOPE_VERSION as Z,CONTINUITY_CLIENT_SCHEMA_VERSION as M,ContinuityClientStateStore as de}from"../continuity/continuity-client-state-store.js";import{isContinuityPublicStage as Me,normalizeContinuityStageIteration as Ue,openContinuitySqliteStore as ce,sanitizeContinuityStageHistory as Fe}from"../continuity/sqlite-store.js";const d=Object.freeze({OK:"continuity-ok",AUTH_TOKEN_PERMISSION_FAILURE:"auth-token-permission-failure",BACKOFF_SCHEDULED:"backoff-scheduled",COMMAND_EXPIRED:"command-expired",IDEMPOTENCY_REPLAY:"idempotency-replay",INVALID_STATE_TRANSITION:"invalid-state-transition",JOB_CANCELLED:"job-cancelled",PORTAL_COMMAND_LOCAL_AUDIT_RECORDED:"portal-command-local-audit-recorded",PORTAL_COMMAND_PAYLOAD_REJECTED:"portal-command-payload-rejected",PORTAL_SYNC_PAYLOAD_REJECTED:"portal-sync-payload-rejected",RUNNER_DIRECTIVE_UNTRUSTED:"runner-directive-untrusted",SQLITE_ADAPTER_UNAVAILABLE:"sqlite-adapter-unavailable",SQLITE_INTEGRITY_FAILED:"sqlite-integrity-failed",UNSAFE_FIELD_REJECTED:"unsafe-field-rejected",WAITING_HUMAN:"waiting-human"}),ie=new Set(["approve","deny","hold"]),qe=new Set(["option","decisionId","gateId","publicSafe"]),He=6e4,Ve=3e4,Je=1e4,Ye=.2,Be=`${Date.now()}:${Math.random().toString(16).slice(2)}`,ue=new Set(["pause","resume","cancel","run_once","retry","snapshot","approve_review_gate","deny_review_gate","answer_decision"]),le=new Set(["commandId","jobId","action","decision","status","queuedAt","expiresAt","acknowledgedAt","idempotencyKey","delivery","workspaceId","workspaceLabel","runnerId","projectId","projectLabel","reasonCode","publicSafe"]),ye=/^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/,fe=/^runner-[A-Za-z0-9._-]{1,80}$/,ze=/^(?:job|goal|loop|runner)-[A-Za-z0-9._-]{1,80}$/,pe=/^pcmd-[a-f0-9]{8,64}$/i,V=/^[a-z0-9][a-z0-9-]{1,80}$/,W=/(raw[_-]?(?:logs?|payloads?)|std(?:out|err)|stack(?:[_-]?trace)?|transcript|prompt(?:[_-]?(?:body|text))?|private[_-]?(?:urls?|prompts?)|secret|token|password|protected(?:[_-]?(?:field|body|bodies|internals))?|workflow(?:[_-]?body)?|step(?:[_-]?body)?|customer(?:[_-]?(?:pii|data))?|\bpii\b|authorization|api[_-]?key|license[_-]?key|argv|args|executable(?:[_-]?path)?|binary(?:[_-]?path)?|shell|cwd|command[_-]?path|vendor(?:[_-]?(?:payload|corpus|response|output)))/i,g=/(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|P180[_-]?SYNTHETIC[_-]?CONTINUITY|P185[_-]?SYNTHETIC[_-]?CONTINUITY|P187[_-]?SYNTHETIC[_-]?(?:CONTINUITY|RUNNER|WATCH)|P190[_-]?SYNTHETIC[_-]?(?:HEADLESS|CONTINUITY)|P192[_-]?SYNTHETIC[_-]?(?:PORTAL|RUNNER|SYNC))/i,me=/(?:[;&|`$<>]|\$\(|\n|\r|\0|(?:^|\s)(?:bash|sh|zsh|fish|cmd\.exe|powershell|pwsh|npm|pnpm|yarn|node|python|ruby|go|cargo|sudo|chmod|curl|wget)\s+(?:-c|run|exec|install|test|build|[A-Za-z0-9_./:-]+))/i;async function Ge(e={}){const t=ae(e.projectRoot??process.cwd()),r=e.now??(()=>new Date().toISOString()),o=r(),n=ge(e.runnerId??_e(t)),a=Se(e.sessionId)??Ce(t),s=Ae(t,e),{workspaceId:u,workspaceLabel:l,projectId:c,projectLabel:y}=s,h=e.mode??"background",C=[],S=[],L={heartbeat:!1};let b;try{b=await ce({projectRoot:t,adapter:e.adapter,adapterLoader:e.adapterLoader,now:r});const I=new de(b,r,G(t)).collectSnapshot({nowIso:o,jobLimit:_(e.jobLimit??20,1,50),dueJobLimit:20,eventLimit:1,receiptLimit:1,staleLeaseLimit:20,processingSummaryLimit:1,snapshotLimit:1}),k=e.httpClient?e.authToken:await ee(e),H=e.httpClient??Ee(X(e),k),p=Le(e.clientVersion??$,k),v=Ie(I,{runnerId:n,sessionId:a,identity:s,generatedAt:o,schedulerState:e.schedulerState??"unknown",clientVersion:e.clientVersion??$}),j=await F(H,{method:"POST",path:"/api/v1/continuity/runner/heartbeat",body:v,headers:p},{timeoutMs:e.timeoutMs??e.heartbeatTimeoutMs??Je});j.ok?L.heartbeat=!0:C.push(j.reasonCode);const w=bt(I,S.length);return{ok:L.heartbeat,runnerId:n,sessionId:a,workspaceId:u,workspaceLabel:l,projectId:c,projectLabel:y,mode:h,generatedAt:o,serverAccessToLocalhost:!1,serverHeldStream:!1,localhostCallback:!1,posted:L,counts:w,reasonCodes:Y(C.length>0?C:[d.OK]),redactionEvidence:S,publicSafe:!0}}catch(f){const I=ke(f);return{ok:!1,runnerId:n,sessionId:a,workspaceId:u,workspaceLabel:l,projectId:c,projectLabel:y,mode:h,generatedAt:o,serverAccessToLocalhost:!1,serverHeldStream:!1,localhostCallback:!1,posted:L,counts:{redactions:S.length},reasonCodes:[I],redactionEvidence:S,publicSafe:!0}}finally{b?.close()}}async function Ze(e={}){const t=ae(e.projectRoot??process.cwd()),r=e.now??(()=>new Date().toISOString()),o=r(),n=ge(e.runnerId??_e(t)),a=Se(e.sessionId)??Ce(t),s=Ae(t,e),{workspaceId:u,workspaceLabel:l,projectId:c,projectLabel:y}=s,h=e.mode??"manual",C=[],S=[],L=[],b={heartbeat:!1,runnerSync:!1,commandAcks:0},f={polled:0,applied:0,alreadyApplied:0,rejected:0,expired:0,failedLocal:0};let I;try{I=await ce({projectRoot:t,adapter:e.adapter,adapterLoader:e.adapterLoader,now:r});const k=I.compactPublicReceiptsAndOutputs({nowIso:o,policy:e.retentionPolicy}),p=new de(I,r,G(t)).collectSnapshot({nowIso:o,jobLimit:_(e.jobLimit??50,1,50),dueJobLimit:50,eventLimit:_(e.eventLimit??50,1,100),receiptLimit:_(e.receiptLimit??50,1,100),staleLeaseLimit:20,processingSummaryLimit:20,snapshotLimit:10}),v=At(p,o),j=e.httpClient??Ee(X(e),await ee(e)),w=Le(e.clientVersion??$,e.httpClient?e.authToken:await ee(e)),re=Ie(p,{runnerId:n,sessionId:a,identity:s,generatedAt:o,schedulerState:e.schedulerState??"unknown",clientVersion:e.clientVersion??$}),oe=await F(j,{method:"POST",path:"/api/v1/continuity/runner/heartbeat",body:re,headers:w});oe.ok?b.heartbeat=!0:C.push(oe.reasonCode);const Ne=tt(p,{runnerId:n,identity:s,generatedAt:o,previousSyncCursor:e.syncCursor,nextSyncCursor:v,heartbeat:re}),E=rt(I,p,{runnerId:n,identity:s,generatedAt:o,previousSyncCursor:e.syncCursor,nextSyncCursor:v}),B=E.status==="acked"&&E.replay?{ok:!0,body:{reasonCode:d.IDEMPOTENCY_REPLAY,publicSafe:!0}}:E.status==="conflict"||E.status==="dead_letter"?{ok:!1,reasonCode:E.reasonCode??d.BACKOFF_SCHEDULED}:await F(j,{method:"POST",path:"/api/v1/continuity/jobs/sync",body:Ne,headers:w});B.ok?(b.runnerSync=!0,I.ackOutbox({outboxId:E.outboxId,deliveryCursor:E.deliveryCursor,ackedAt:r(),reasonCode:d.OK})):(C.push(B.reasonCode),I.failOutboxDelivery({outboxId:E.outboxId,deliveryCursor:E.deliveryCursor,failedAt:r(),reasonCode:B.reasonCode,summary:"Runner sync delivery failed with a public reason code and will retry or dead-letter by policy.",policy:{maxAttempts:3}}));const z=await F(j,{method:"GET",path:"/api/v1/continuity/runner/commands",query:{runnerId:n,workspaceId:u,workspaceLabel:l,projectId:c,projectLabel:y},headers:w});if(z.ok){const ne=mt(z.body).slice(0,_(e.commandLimit??20,1,20));f.polled=ne.length;for(const De of ne){const R=await We({store:I,http:j,headers:w,rawCommand:De,runnerId:n,identity:s,nowIso:r()});L.push(R),b.commandAcks+=1,R.localStatus==="applied"?f.applied+=1:R.localStatus==="already_applied"?f.alreadyApplied+=1:R.localStatus==="rejected"?f.rejected+=1:R.localStatus==="expired"?f.expired+=1:f.failedLocal+=1,S.push(...R.redactionEvidence),C.push(R.reasonCode)}}else C.push(z.reasonCode);const Oe={jobs:p.counts.jobs??p.jobs.length,dueJobs:p.dueJobCount,receipts:p.counts.receipts??p.lastReceipts.length,events:p.counts.events??p.lastEvents.length,commandsPolled:f.polled,commandAcks:b.commandAcks,commandApplied:f.applied,commandAlreadyApplied:f.alreadyApplied,commandRejected:f.rejected,commandExpired:f.expired,commandFailedLocal:f.failedLocal,receiptCompactionSummaries:k.counts.summariesCreated,receiptsCompacted:k.counts.receiptsRemoved,processingSummariesCompacted:k.counts.outputsRemoved,redactions:S.length,...N(p)},Pe=Y(C.length>0?C:[d.OK]);return{ok:b.heartbeat&&b.runnerSync&&f.failedLocal===0,runnerId:n,sessionId:a,workspaceId:u,workspaceLabel:l,projectId:c,projectLabel:y,mode:h,generatedAt:o,serverAccessToLocalhost:!1,serverHeldStream:!1,localhostCallback:!1,posted:b,commandPoll:f,sync:{...e.syncCursor?{previousSyncCursor:e.syncCursor}:{},nextSyncCursor:v,counts:Oe},commandAcks:L,reasonCodes:Pe,redactionEvidence:S.slice(0,50),publicSafe:!0}}catch(k){const H=ke(k);return{ok:!1,runnerId:n,sessionId:a,workspaceId:u,workspaceLabel:l,projectId:c,projectLabel:y,mode:h,generatedAt:o,serverAccessToLocalhost:!1,serverHeldStream:!1,localhostCallback:!1,posted:b,commandPoll:f,sync:{nextSyncCursor:`sync-${A(o).slice(0,24)}`,counts:{commandAcks:0}},commandAcks:L,reasonCodes:[H],redactionEvidence:S,publicSafe:!0}}finally{I?.close()}}async function vt(e={}){const t=_(e.maxRuns??1,1,1e4),r=_(e.intervalMs??6e4,0,1440*60*1e3),o=[];let n=e.syncCursor;for(let a=0;a<t;a++){const s=await Ze({...e,mode:e.mode??"background",syncCursor:n});o.push(s),n=s.sync.nextSyncCursor,a<t-1&&r>0&&await xe(r)}return{ok:o.every(a=>a.ok),runs:o,reasonCodes:Y(o.flatMap(a=>a.reasonCodes)),publicSafe:!0}}async function $t(e={}){const t=_(e.maxRuns??1,1,1e4),r=_(e.intervalMs??He,0,1440*60*1e3),o=_(e.backoffMs??Ve,1e3,1800*1e3),n=Te(e.jitterRatio??Ye,0,.5),a=e.random??Math.random,s=[];for(let u=0;u<t;u++){const l=await Ge({...e,mode:e.mode??"background"});if(s.push(l),u<t-1){const c=l.ok?r:o,y=ht(c,n,a);y>0&&await xe(y)}}return{ok:s.every(u=>u.ok),runs:s,reasonCodes:Y(s.flatMap(u=>u.reasonCodes)),schedule:{intervalMs:r,backoffMs:o,jitterRatio:n,maxRuns:t},publicSafe:!0}}async function We(e){const t=ft(e.rawCommand);if(!t.ok||!t.command)return Xe(e.store,t,e.runnerId,e.nowIso),T(e.http,e.headers,{commandId:t.commandId??`pcmd-${A("invalid-command").slice(0,16)}`,jobId:t.jobId,action:t.action,runnerId:e.runnerId,identity:e.identity,idempotencyKey:`invalid:${t.commandId??"unknown"}`,localStatus:"rejected",remoteStatus:"rejected",reasonCode:d.PORTAL_COMMAND_PAYLOAD_REJECTED,publicSummary:"Runner rejected unsafe Portal command before local application.",acknowledgedAt:e.nowIso,redactionEvidence:t.redactions,counts:{rejected:1,redactions:t.redactions.length}});const r=t.command,o=U(r.commandId),n={commandId:r.commandId,jobId:r.jobId,action:r.action,runnerId:e.runnerId,identity:e.identity,idempotencyKey:r.idempotencyKey,acknowledgedAt:e.nowIso,redactionEvidence:t.redactions};if(r.expiresAt&&Date.parse(r.expiresAt)<=Date.parse(e.nowIso))return Q(e.store,r,{operationId:o,status:"ignored",reasonCode:d.COMMAND_EXPIRED,createdAt:e.nowIso,summary:"Portal command expired before local application.",redactionEvidence:t.redactions}),T(e.http,e.headers,{...n,localStatus:"expired",remoteStatus:"expired",reasonCode:d.COMMAND_EXPIRED,publicSummary:"Runner skipped expired Portal command.",counts:{expired:1}});if(e.store.hasOperationRef(o,r.idempotencyKey))return et(e.store,r,o,e.runnerId,e.nowIso,t.redactions),T(e.http,e.headers,{...n,localStatus:"already_applied",remoteStatus:"applied",reasonCode:d.IDEMPOTENCY_REPLAY,publicSummary:"Runner already applied Portal command; duplicate poll was acknowledged without local mutation.",counts:{alreadyApplied:1}});if(!e.store.jobExists(r.jobId))return T(e.http,e.headers,{...n,localStatus:"failed-local",remoteStatus:"rejected",reasonCode:d.INVALID_STATE_TRANSITION,publicSummary:"Runner could not find the public job for Portal command application.",counts:{failedLocal:1}});try{const a=be(r);return e.store.runInTransaction(()=>{Qe(e.store,r,e.nowIso),e.store.appendEvent({eventId:`${o}:event`,jobId:r.jobId,operationId:o,idempotencyKey:r.idempotencyKey,type:"portal_command_applied",summary:`Portal command ${r.action} applied locally by runner.`,reasonCode:a,createdAt:e.nowIso,metadata:x(r,o,e.runnerId,"applied",e.nowIso,t.redactions,a)}),e.store.appendReceipt({receiptId:`receipt-${o}`,jobId:r.jobId,operationId:o,idempotencyKey:r.idempotencyKey,status:"applied",reasonCode:a,appliedOperationIds:[o],createdAt:e.nowIso,metadata:x(r,o,e.runnerId,"applied",e.nowIso,t.redactions,a)})}),T(e.http,e.headers,{...n,localStatus:"applied",remoteStatus:"applied",reasonCode:a,publicSummary:`Runner applied Portal command ${r.action} locally.`,counts:{applied:1}})}catch{return Q(e.store,r,{operationId:o,status:"failed",reasonCode:d.INVALID_STATE_TRANSITION,createdAt:e.nowIso,summary:"Portal command failed local application with public reason code.",redactionEvidence:t.redactions}),T(e.http,e.headers,{...n,localStatus:"failed-local",remoteStatus:"rejected",reasonCode:d.INVALID_STATE_TRANSITION,publicSummary:"Runner failed local Portal command application with public reason code.",counts:{failedLocal:1}})}}function Qe(e,t,r){switch(t.action){case"pause":e.updateJobAndExistingGoalCampaignStatus({jobId:t.jobId,status:"paused",updatedAt:r,reasonCode:d.WAITING_HUMAN});return;case"resume":case"approve_review_gate":e.updateJobAndExistingGoalCampaignStatus({jobId:t.jobId,status:"active",updatedAt:r,reasonCode:d.OK});return;case"cancel":case"deny_review_gate":e.updateJobAndExistingGoalCampaignStatus({jobId:t.jobId,status:"cancelled",updatedAt:r,reasonCode:d.JOB_CANCELLED});return;case"answer_decision":if(t.decision?.option==="approve"){e.updateJobAndExistingGoalCampaignStatus({jobId:t.jobId,status:"active",updatedAt:r,reasonCode:d.OK});return}if(t.decision?.option==="deny"){e.updateJobAndExistingGoalCampaignStatus({jobId:t.jobId,status:"cancelled",updatedAt:r,reasonCode:d.JOB_CANCELLED});return}if(t.decision?.option==="hold"){e.updateJobAndExistingGoalCampaignStatus({jobId:t.jobId,status:"blocked",updatedAt:r,reasonCode:d.WAITING_HUMAN});return}throw new Error("unsupported-review-gate-decision");case"run_once":case"retry":e.scheduleNextTick({jobId:t.jobId,scheduledAt:r,updatedAt:r,reasonCode:d.OK});return;case"snapshot":e.recordStateSnapshot({snapshotId:`snapshot-${U(t.commandId)}`,jobId:t.jobId,kind:"portal_command_snapshot",summary:"Portal snapshot command recorded public local state checkpoint request.",capturedAt:r,operationId:U(t.commandId),idempotencyKey:t.idempotencyKey,metadata:x(t,U(t.commandId),t.runnerId,"applied",r,[],d.OK)});return;default:throw new Error("unsupported-command-action")}}async function T(e,t,r){return await F(e,{method:"POST",path:`/api/v1/continuity/runner/commands/${encodeURIComponent(r.commandId)}/ack`,body:{status:r.remoteStatus,runnerId:r.runnerId,workspaceId:r.identity.workspaceId,workspaceLabel:r.identity.workspaceLabel,projectId:r.identity.projectId,projectLabel:r.identity.projectLabel,idempotencyKey:r.idempotencyKey,reasonCode:r.reasonCode,publicSummary:m(r.publicSummary,280),counts:Re(r.counts),redactionEvidence:r.redactionEvidence.slice(0,20),publicSafe:!0},headers:t}),{commandId:r.commandId,...r.jobId?{jobId:r.jobId}:{},workspaceId:r.identity.workspaceId,workspaceLabel:r.identity.workspaceLabel,projectId:r.identity.projectId,projectLabel:r.identity.projectLabel,...r.action?{action:r.action}:{},localStatus:r.localStatus,remoteStatus:r.remoteStatus,reasonCode:r.reasonCode,publicSummary:m(r.publicSummary,280),acknowledgedAt:r.acknowledgedAt,counts:r.counts,redactionEvidence:r.redactionEvidence.slice(0,20),publicSafe:!0}}function Q(e,t,r){try{if(!e.jobExists(t.jobId)||e.hasOperationRef(r.operationId,t.idempotencyKey))return;e.appendReceipt({receiptId:`receipt-${r.operationId}`,jobId:t.jobId,operationId:r.operationId,idempotencyKey:t.idempotencyKey,status:r.status,reasonCode:r.reasonCode,ignoredOperationIds:[r.operationId],createdAt:r.createdAt,metadata:x(t,r.operationId,t.runnerId,r.status,r.createdAt,r.redactionEvidence,r.reasonCode)}),e.appendEvent({eventId:`${r.operationId}:event`,jobId:t.jobId,operationId:`${r.operationId}:event`,idempotencyKey:`${t.idempotencyKey}:event`,type:r.status==="failed"?"portal_command_failed":"portal_command_rejected",summary:r.summary,reasonCode:r.reasonCode,createdAt:r.createdAt,metadata:x(t,r.operationId,t.runnerId,r.status,r.createdAt,r.redactionEvidence,r.reasonCode)})}catch{}}function Xe(e,t,r,o){if(!t.commandId||!pe.test(t.commandId)||!t.jobId||!J(t.jobId)||!t.action||!ue.has(t.action))return;const n={commandId:t.commandId,jobId:t.jobId,action:t.action,status:"queued",queuedAt:o,idempotencyKey:`rejected:${t.commandId}`,delivery:"runner_poll",runnerId:r,reasonCode:d.PORTAL_COMMAND_PAYLOAD_REJECTED,publicSafe:!0};Q(e,n,{operationId:`${U(t.commandId)}:rejected`,status:"ignored",reasonCode:d.PORTAL_COMMAND_PAYLOAD_REJECTED,createdAt:o,summary:"Runner rejected unsafe Portal command before local application.",redactionEvidence:t.redactions})}function et(e,t,r,o,n,a){const s=`${r}:replay`;try{if(!e.jobExists(t.jobId)||e.hasOperationRef(s,`${t.idempotencyKey}:replay`))return;e.appendEvent({eventId:`${s}:event`,jobId:t.jobId,operationId:s,idempotencyKey:`${t.idempotencyKey}:replay`,type:"portal_command_replay",summary:"Runner recorded idempotent Portal command replay without local mutation.",reasonCode:d.IDEMPOTENCY_REPLAY,createdAt:n,metadata:x(t,s,o,"already_applied",n,a,d.IDEMPOTENCY_REPLAY)})}catch{}}function Ie(e,t){const r=It(e),o=e.jobs.filter(s=>["planned","active","running","backoff","waiting_external","waiting_human"].includes(s.status)).map(s=>s.jobId).filter(J).slice(0,20),n=e.staleLeases.map(s=>s.leaseId).filter(P).slice(0,20),a=we(e.dueJobs.map(s=>s.nextRunAt).filter(s=>!!s));return{schemaVersion:M,contractVersion:K,runnerId:t.runnerId,...t.sessionId?{sessionId:t.sessionId}:{},workspaceId:t.identity.workspaceId,workspaceLabel:t.identity.workspaceLabel,projectId:t.identity.projectId,projectLabel:t.identity.projectLabel,status:r,observedAt:t.generatedAt,version:m(t.clientVersion,80),activeJobIds:o,leaseIds:n,...a?{nextTickAt:a}:{},schedulerState:t.schedulerState,doctorSummary:r==="degraded"?"Runner sync is degraded by public stale lease or retryable outbox counts.":"Runner sync heartbeat contains public local continuity summaries.",reasonCode:r==="degraded"?d.BACKOFF_SCHEDULED:d.OK,queue:{depth:e.queue.depth,queued:e.queue.queued,running:e.queue.running,retrying:e.queue.retrying,deadLetter:e.queue.deadLetter,capacity:e.queue.capacity,available:e.queue.available,backpressure:e.queue.backpressure,generatedAt:e.queue.generatedAt,...e.queue.nextRetryAt?{nextRetryAt:e.queue.nextRetryAt}:{},...e.queue.reasonCode?{reasonCode:q(e.queue.reasonCode)}:{},publicSafe:!0},metadata:{schemaVersion:M,contractVersion:K,transportKind:"runner_heartbeat",...t.sessionId?{sessionId:t.sessionId}:{},workspaceId:t.identity.workspaceId,workspaceLabel:t.identity.workspaceLabel,projectId:t.identity.projectId,projectLabel:t.identity.projectLabel,observedAt:t.generatedAt,serverAccessToLocalhost:!1,serverHeldStream:!1,counts:{jobs:e.counts.jobs??e.jobs.length,dueJobs:e.dueJobCount,activeLeases:e.counts.activeLeases??0,staleLeases:e.counts.staleLeases??e.staleLeases.length,outboxPending:e.outbox.pending??0,outboxFailed:(e.outbox.failed??0)+(e.outbox.deadLetter??0),...N(e)},reasonCodes:[r==="degraded"?d.BACKOFF_SCHEDULED:d.OK],publicSummary:"Runner heartbeat generated from local continuity SQLite public summaries."},publicSafe:!0}}function tt(e,t){const r=e.jobs.map(s=>dt(s,t.identity,e)).slice(0,50),o=[...e.lastEvents.map(it),...(e.headlessExecutionAttempts??[]).map(ut)].slice(0,100),n=e.lastReceipts.map(lt).slice(0,100),a=yt(e,t.generatedAt);return{runnerId:t.runnerId,workspaceId:t.identity.workspaceId,workspaceLabel:t.identity.workspaceLabel,projectId:t.identity.projectId,projectLabel:t.identity.projectLabel,runner:{...t.heartbeat,metadata:{schemaVersion:M,contractVersion:K,syncVersion:Z,transportKind:"runner_sync",workspaceId:t.identity.workspaceId,workspaceLabel:t.identity.workspaceLabel,projectId:t.identity.projectId,projectLabel:t.identity.projectLabel,syncCursor:t.previousSyncCursor??"sync-initial",nextSyncCursor:t.nextSyncCursor,generatedAt:t.generatedAt,serverAccessToLocalhost:!1,serverHeldStream:!1,counts:{jobs:r.length,events:o.length,receipts:n.length,outbox:a.length,headlessExecutionAttempts:e.headlessExecutionAttempts?.length??0,...N(e)},publicSummary:"Runner sync uploaded public job, event and receipt summaries."}},jobs:r,events:o,receipts:n,outbox:a,runnerSync:{runnerId:t.runnerId,workspaceId:t.identity.workspaceId,workspaceLabel:t.identity.workspaceLabel,projectId:t.identity.projectId,projectLabel:t.identity.projectLabel,syncCursor:t.previousSyncCursor??"sync-initial",nextSyncCursor:t.nextSyncCursor,generatedAt:t.generatedAt,publicSummary:"Runner sync uploaded public job, event and receipt summaries.",counts:{jobs:r.length,events:o.length,receipts:n.length,outbox:a.length,...N(e)},publicSafe:!0}}}function rt(e,t,r){const o=ot({runnerId:r.runnerId,workspaceId:r.identity.workspaceId,projectId:r.identity.projectId,nextSyncCursor:r.nextSyncCursor}),n=nt({runnerId:r.runnerId,workspaceId:r.identity.workspaceId,projectId:r.identity.projectId,nextSyncCursor:r.nextSyncCursor});return e.enqueueOutbox({outboxId:o,jobId:st(t),operationId:`op-${o}`,idempotencyKey:`idem-${o}`,type:"runner_sync",status:"pending",payload:at(t,r),createdAt:r.generatedAt,updatedAt:r.generatedAt}),e.markOutboxSent({outboxId:o,deliveryCursor:n,sentAt:r.generatedAt,reasonCode:d.OK})}function ot(e){return`outbox-runner-sync-${A(`${e.runnerId}:${e.workspaceId}:${e.projectId??"project"}:${e.nextSyncCursor}`).slice(0,32)}`}function nt(e){return`cursor-runner-sync-${A(`${e.workspaceId}:${e.projectId??"project"}:${e.runnerId}:${e.nextSyncCursor}`).slice(0,32)}`}function at(e,t){return{schemaVersion:M,contractVersion:K,syncVersion:Z,transportKind:"runner_sync",envelopeId:`runner-sync-${A(`${t.runnerId}:${t.nextSyncCursor}`).slice(0,24)}`,runnerId:t.runnerId,workspaceId:t.identity.workspaceId,workspaceLabel:t.identity.workspaceLabel,projectId:t.identity.projectId,projectLabel:t.identity.projectLabel,syncCursor:t.previousSyncCursor??"sync-initial",nextSyncCursor:t.nextSyncCursor,generatedAt:t.generatedAt,serverAccessToLocalhost:!1,serverHeldStream:!1,counts:{jobs:e.counts.jobs??e.jobs.length,events:e.counts.events??e.lastEvents.length,receipts:e.counts.receipts??e.lastReceipts.length,outboxPending:e.outbox.pending??0,outboxFailed:e.outbox.failed??0,outboxDeadLetter:e.outbox.deadLetter??0,headlessExecutionAttempts:e.headlessExecutionAttempts?.length??0,...N(e)},redactionEvidence:[{field:"runnerSyncBody",reason:"unbounded_text",evidence:"operation-denied",publicSafe:!0}],publicSummary:"Runner sync outbox stores public IDs, counts, redaction evidence and cursor state only."}}function st(e){return e.jobs.map(t=>t.jobId).find(J)}function dt(e,t,r){const o=Me(e.currentStage)?e.currentStage:void 0,n=Fe(e.stageHistory),a=Ue(e.iteration),s=ct(e.jobId,r);return{jobId:e.jobId,workspaceId:t.workspaceId,workspaceLabel:t.workspaceLabel,projectId:t.projectId,projectLabel:t.projectLabel,kind:Lt(e.kind),status:kt(e.status),publicSummary:m(e.publicSummary,240),updatedAt:e.updatedAt,...e.nextRunAt?{nextRunAt:e.nextRunAt}:{},...e.reasonCode?{reasonCode:q(e.reasonCode)}:{},...e.counts?{counts:Re(e.counts)}:{},...s?{operations:s}:{},...o?{currentStage:o}:{},...n.length>0?{stageHistory:n}:{},...a!==void 0?{iteration:a}:{},publicSafe:!0}}function ct(e,t){const r=(t.headlessExecutionAttempts??[]).filter(c=>c.jobId===e).slice(0,50),o=t.staleLeases.filter(c=>c.jobId===e).slice(0,50);if(r.length===0&&o.length===0)return;const n=r.filter(c=>c.status==="backoff"||c.retryCount>0&&!!c.nextRetryAt).length,a=r.filter(c=>!!c.deadLetteredAt||c.status==="dead_letter").length,s=r.filter(c=>["queued","pending","backoff"].includes(c.status)).length,u=we(r.map(c=>c.nextRetryAt).filter(c=>!!c)),l=[...r].map(c=>c.leaseExpiresAt).filter(c=>!!c).sort().at(-1);return{attempts:r.length,retries:r.reduce((c,y)=>c+Math.max(0,Math.trunc(y.retryCount)),0),retrying:n,deadLetter:a,activeLeases:r.filter(c=>!!c.leaseId&&c.status==="running").length,staleLeases:o.length,queueDepth:s,backpressure:t.queue.backpressure&&s>0,generatedAt:t.generatedAt,...u?{nextRetryAt:u}:{},...l?{latestLeaseExpiresAt:l}:{},publicSafe:!0}}function it(e){return{eventId:e.eventId,jobId:e.jobId,operationId:e.operationId,type:m(e.type,80),summary:m(e.publicSummary,240),publicSummary:m(e.publicSummary,240),createdAt:e.createdAt,...e.metadata?{metadata:e.metadata}:{},...e.reasonCode?{reasonCode:q(e.reasonCode)}:{},publicSafe:!0}}function ut(e){return{eventId:`headless-${O(e.attemptId)}`,jobId:e.jobId,operationId:e.executionId,type:"headless_execution_attempt",summary:m(e.publicSummary,240),publicSummary:m(e.publicSummary,240),createdAt:e.heartbeatAt??e.enqueuedAt,...e.reasonCode?{reasonCode:q(e.reasonCode)}:{},publicSafe:!0}}function lt(e){return{receiptId:e.receiptId,jobId:e.jobId,...e.operationId?{operationId:e.operationId}:{},status:gt(e.status),summary:`Runner receipt ${e.status} for ${e.jobId}.`,createdAt:e.createdAt,...e.reasonCode?{reasonCode:q(e.reasonCode)}:{},publicSafe:!0}}function yt(e,t){const r=[];for(const[o,n]of Object.entries(e.outbox))o==="total"||!Number.isFinite(n)||n<=0||r.push({outboxId:`outbox-${o}`,operationId:`outbox-${o}-${A(t).slice(0,12)}`,status:o==="failed"||o==="deadLetter"?"failed":o==="acked"||o==="sent"?"applied":"accepted",summary:`Outbox ${o} count ${Math.trunc(n)} synced as public status evidence.`,updatedAt:t,reasonCode:o==="failed"||o==="deadLetter"?d.BACKOFF_SCHEDULED:d.OK,counts:{[o]:Math.trunc(n)},publicSafe:!0});return r.slice(0,20)}function ft(e){const t=[];if(!D(e))return t.push(i("command","unsafe_key","operation-denied")),{ok:!1,reasonCode:d.UNSAFE_FIELD_REJECTED,redactions:t};for(const y of Object.keys(e))(!le.has(y)||W.test(y))&&t.push(i(`command.${m(y,80)}`,"unsafe_key","key-denied"));for(const[y,h]of Object.entries(e))le.has(y)&&te(h,`command.${y}`,t);const r=typeof e.commandId=="string"?e.commandId:void 0,o=typeof e.jobId=="string"?e.jobId:void 0,n=typeof e.action=="string"?e.action:void 0,a=typeof e.status=="string"?e.status:void 0,s=typeof e.queuedAt=="string"?e.queuedAt:void 0,u=typeof e.idempotencyKey=="string"?e.idempotencyKey:void 0,l=typeof e.delivery=="string"?e.delivery:void 0;(!r||!pe.test(r))&&t.push(i("command.commandId","unsafe_key")),(!o||!J(o))&&t.push(i("command.jobId","unsafe_key")),(!n||!ue.has(n))&&t.push(i("command.action","unsafe_key")),a!=="queued"&&t.push(i("command.status","unsafe_key"));const c=pt(e.decision,n,t);return(!s||!Number.isFinite(Date.parse(s)))&&t.push(i("command.queuedAt","unsafe_key")),(!u||!P(u))&&t.push(i("command.idempotencyKey","unsafe_key")),l!=="runner_poll"&&t.push(i("command.delivery","unsafe_key")),e.publicSafe!==!0&&t.push(i("command.publicSafe","unsafe_key")),typeof e.expiresAt=="string"&&!Number.isFinite(Date.parse(e.expiresAt))&&t.push(i("command.expiresAt","unsafe_key")),typeof e.workspaceId=="string"&&!P(e.workspaceId)&&t.push(i("command.workspaceId","unsafe_key")),typeof e.workspaceLabel=="string"&&!je(e.workspaceLabel)&&t.push(i("command.workspaceLabel","unsafe_key")),typeof e.runnerId=="string"&&!fe.test(e.runnerId)&&t.push(i("command.runnerId","unsafe_key")),typeof e.projectId=="string"&&!P(e.projectId)&&t.push(i("command.projectId","unsafe_key")),typeof e.projectLabel=="string"&&!je(e.projectLabel)&&t.push(i("command.projectLabel","unsafe_key")),typeof e.reasonCode=="string"&&!V.test(e.reasonCode)&&t.push(i("command.reasonCode","unsafe_key")),t.length>0||!r||!o||!n||!s||!u||!l?{ok:!1,commandId:r,jobId:o,action:n,reasonCode:d.UNSAFE_FIELD_REJECTED,redactions:Et(t)}:{ok:!0,command:{commandId:r,jobId:o,action:n,...c?{decision:c}:{},status:a??"queued",queuedAt:s,...typeof e.expiresAt=="string"?{expiresAt:e.expiresAt}:{},idempotencyKey:u,delivery:l??"runner_poll",...typeof e.workspaceId=="string"?{workspaceId:e.workspaceId}:{},...typeof e.workspaceLabel=="string"?{workspaceLabel:e.workspaceLabel}:{},...typeof e.runnerId=="string"?{runnerId:e.runnerId}:{},...typeof e.projectId=="string"?{projectId:e.projectId}:{},...typeof e.projectLabel=="string"?{projectLabel:e.projectLabel}:{},...typeof e.reasonCode=="string"?{reasonCode:e.reasonCode}:{},publicSafe:!0},reasonCode:d.OK,redactions:[]}}function pt(e,t,r){if(t!=="answer_decision"&&t!=="approve_review_gate"&&t!=="deny_review_gate"){e!==void 0&&r.push(i("command.decision","unsafe_key"));return}if(e===void 0){t==="answer_decision"&&r.push(i("command.decision","unsafe_key"));return}if(!D(e)){r.push(i("command.decision","unsafe_key"));return}for(const n of Object.keys(e))(!qe.has(n)||W.test(n))&&r.push(i(`command.decision.${m(n,80)}`,"unsafe_key","key-denied"));const o=typeof e.option=="string"?e.option:void 0;if((!o||!ie.has(o))&&r.push(i("command.decision.option","unsafe_key")),typeof e.decisionId=="string"&&!P(e.decisionId)&&r.push(i("command.decision.decisionId","unsafe_key")),typeof e.gateId=="string"&&!P(e.gateId)&&r.push(i("command.decision.gateId","unsafe_key")),t==="approve_review_gate"&&o!=="approve"&&r.push(i("command.decision.option","unsafe_key")),t==="deny_review_gate"&&o!=="deny"&&r.push(i("command.decision.option","unsafe_key")),!(!o||!ie.has(o)))return{option:o,...typeof e.decisionId=="string"?{decisionId:e.decisionId}:{},...typeof e.gateId=="string"?{gateId:e.gateId}:{},publicSafe:!0}}function mt(e){return D(e)?Array.isArray(e.commands)?e.commands:[]:[]}function x(e,t,r,o,n,a,s){const u=s??be(e),l=r??e.runnerId;return{schemaVersion:M,contractVersion:K,syncVersion:Z,transportKind:"command_ack",actorType:"runner",...l?{actorId:l,runnerId:l}:{},jobId:e.jobId,...e.workspaceId?{workspaceId:e.workspaceId}:{},...e.workspaceLabel?{workspaceLabel:e.workspaceLabel}:{},...e.projectId?{projectId:e.projectId}:{},...e.projectLabel?{projectLabel:e.projectLabel}:{},operationId:t,idempotencyKey:e.idempotencyKey,commandId:e.commandId,commandKind:e.action,...e.decision?{decisionOption:e.decision.option}:{},...e.decision?.decisionId?{decisionId:e.decision.decisionId}:{},...e.decision?.gateId?{gateId:e.decision.gateId}:{},commandStatus:o,auditStatus:o,acknowledgedAt:n,reasonCode:u,redactionCount:a.length,redactionEvidence:a.slice(0,20),counts:{redactions:a.length},publicSummary:`Portal command ${e.action} ${o}.`}}function U(e){return`portal-command-${O(e)}`}function be(e){return e.action==="cancel"||e.action==="deny_review_gate"||e.action==="answer_decision"&&e.decision?.option==="deny"?d.JOB_CANCELLED:e.action==="pause"||e.action==="answer_decision"&&e.decision?.option==="hold"?d.WAITING_HUMAN:d.OK}function It(e){return(e.counts.staleLeases??0)>0||(e.outbox.failed??0)>0||(e.outbox.deadLetter??0)>0||e.queue.backpressure?"degraded":(e.counts.activeLeases??0)>0||e.dueJobCount>0||(e.counts.headlessRunningAttempts??0)>0?"busy":"idle"}function bt(e,t){return{jobs:e.counts.jobs??e.jobs.length,dueJobs:e.dueJobCount,activeLeases:e.counts.activeLeases??0,staleLeases:e.counts.staleLeases??e.staleLeases.length,headlessRunningAttempts:e.counts.headlessRunningAttempts??0,outboxPending:e.outbox.pending??0,outboxFailed:(e.outbox.failed??0)+(e.outbox.deadLetter??0),redactions:t,...N(e)}}function N(e){return{queueDepth:e.queue.depth,queueQueued:e.queue.queued,queueRunning:e.queue.running,queueRetrying:e.queue.retrying,queueDeadLetter:e.queue.deadLetter,queueCapacity:e.queue.capacity,queueAvailable:e.queue.available,queueBackpressure:e.queue.backpressure?1:0}}function At(e,t){return`sync-${A(JSON.stringify({generatedAt:t,counts:e.counts,outbox:e.outbox})).slice(0,24)}`}function Ae(e,t){const r=G(e),o=O(t.workspaceId??r.workspaceId),n=O(t.projectId??r.projectId),a=he(t.projectLabel??(t.projectId?void 0:r.projectLabel),t.projectId?`Project ${n}`:r.projectLabel),s=he(t.workspaceLabel??(t.workspaceId?void 0:r.workspaceLabel),t.workspaceId?`Workspace ${o}`:r.workspaceLabel);return{workspaceId:o,workspaceLabel:s,projectId:n,projectLabel:a}}function _e(e){return`runner-${A(e).slice(0,16)}`}function Ce(e){return`session-${A(`${e}:${process.pid}:${Be}`).slice(0,16)}`}function Se(e){if(!e)return;const t=O(e);return ye.test(t)?t.slice(0,96):void 0}function X(e){return(e.serverUrl??process.env.NEOCORTEX_SERVER_URL??se()?.serverUrl??$e).replace(/\/+$/,"")}async function ee(e){if(e.authToken)return e.authToken;if(e.httpClient)return;const t=X(e),r=e.licenseKey??se()?.licenseKey;if(r)return await new Ke({serverUrl:t,licenseKey:r,clientVersion:e.clientVersion??$}).getToken()??void 0}function Ee(e,t){return async r=>{if(!t)return{ok:!1,status:401,body:{reasonCode:d.AUTH_TOKEN_PERMISSION_FAILURE}};const o=new URL(`${e}${r.path}`);for(const[u,l]of Object.entries(r.query??{}))l!==void 0&&o.searchParams.set(u,l);const n=await fetch(o,{method:r.method,headers:r.headers,body:r.method==="POST"?JSON.stringify(r.body??{}):void 0}),a=await n.text().catch(()=>"");let s;try{s=a?JSON.parse(a):void 0}catch{s=void 0}return{ok:n.ok,status:n.status,body:s}}}function Le(e,t){return{"Content-Type":"application/json","X-Client-Version":m(e,80),...t?{Authorization:`Bearer ${t}`}:{}}}async function F(e,t,r={}){try{const o=_(r.timeoutMs??0,0,6e4),n=o>0?await Ct(e(t),o):await e(t);return n.ok?{ok:!0,body:n.body}:{ok:!1,reasonCode:_t(n.body,n.status),body:n.body}}catch{return{ok:!1,reasonCode:d.BACKOFF_SCHEDULED}}}function _t(e,t){if(D(e)){const r=typeof e.reasonCode=="string"?e.reasonCode:typeof e.error_code=="string"?e.error_code.toLowerCase().replaceAll("_","-"):void 0;if(r&&V.test(r))return r}return t===401||t===403?d.AUTH_TOKEN_PERMISSION_FAILURE:t===400?d.PORTAL_SYNC_PAYLOAD_REJECTED:d.BACKOFF_SCHEDULED}function ke(e){if(D(e)){const r=typeof e.reasonCode=="string"?e.reasonCode:typeof e.code=="string"?e.code:void 0;if(r&&V.test(r))return r}const t=e instanceof Error?e.message:String(e);return/sqlite-adapter-unavailable/i.test(t)?d.SQLITE_ADAPTER_UNAVAILABLE:/integrity|corrupt|malformed|not a database/i.test(t)?d.SQLITE_INTEGRITY_FAILED:d.BACKOFF_SCHEDULED}function Ct(e,t){return new Promise((r,o)=>{const n=setTimeout(()=>o(new Error("portal-http-timeout")),t);typeof n.unref=="function"&&n.unref(),e.then(a=>{clearTimeout(n),r(a)},a=>{clearTimeout(n),o(a)})})}function te(e,t,r){if(typeof e=="string"){g.test(e)&&r.push(i(t,St(e),"value-denied"));return}if(!(e===null||typeof e=="number"||typeof e=="boolean"||e===void 0)){if(Array.isArray(e)){for(const[o,n]of e.entries())te(n,`${t}.${o}`,r);return}if(D(e))for(const[o,n]of Object.entries(e)){const a=`${t}.${m(o,80)}`;W.test(o)&&r.push(i(a,"unsafe_key","key-denied")),te(n,a,r)}}}function St(e){return/https?:\/\//i.test(e)?"private_url":/(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)/i.test(e)?"local_absolute_path":/secret|token|password|api[_-]?key|license[_-]?key|authorization/i.test(e)?"secret":/stdout|stderr|raw[_-]?log|transcript|stack/i.test(e)?"raw_log":/prompt|workflow body|step body/i.test(e)?"prompt_body":"protected_field"}function i(e,t,r="value-denied"){return{field:m(e,120),reason:t,evidence:r,publicSafe:!0}}function Et(e){const t=new Set,r=[];for(const o of e){const n=`${o.field}:${o.reason}:${o.evidence}`;t.has(n)||(t.add(n),r.push(o))}return r.slice(0,20)}function ge(e){const t=O(e);return fe.test(t)?t:`runner-${A(e).slice(0,16)}`}function O(e){if(g.test(e))return`id-${A(e).slice(0,16)}`;const t=e.replace(/[^A-Za-z0-9._:-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,120);return t.length>0?t:`id-${A(e).slice(0,16)}`}function he(e,t){const r=(e??"").replace(/\s+/g," ").trim();if(!r||g.test(r)||me.test(r))return t;const o=r.replace(/[^A-Za-z0-9 ._-]+/g," ").replace(/\s+/g," ").trim();return o?o.length<=80?o:`${o.slice(0,77)}...`:t}function P(e){return ye.test(e)&&!g.test(e)}function je(e){return e.trim().length>0&&e.length<=80&&!g.test(e)&&!me.test(e)}function J(e){return ze.test(e)&&!g.test(e)}function q(e){return V.test(e)&&!g.test(e)?e:d.OK}function Lt(e){return["goal","loop","runner","jobs"].includes(e)?e:"jobs"}function kt(e){return["draft","planned","active","running","waiting_external","waiting_human","backoff","paused","blocked","completed","aborted","cancelled"].includes(e)?e:"active"}function gt(e){return["accepted","applied","ignored","failed","deferred"].includes(e)?e:"accepted"}function Re(e){const t={};for(const[r,o]of Object.entries(e))/^[A-Za-z][A-Za-z0-9_:-]{0,63}$/.test(r)&&Number.isFinite(o)&&o>=0&&(t[r]=Math.trunc(o));return t}function we(e){return e.filter(t=>Number.isFinite(Date.parse(t))).sort()[0]}function _(e,t,r){return Number.isFinite(e)?Math.max(t,Math.min(r,Math.floor(e))):t}function Te(e,t,r){return Number.isFinite(e)?Math.max(t,Math.min(r,e)):t}function ht(e,t,r){if(e<=0)return 0;if(t<=0)return e;const o=Te(r(),0,1),n=Math.floor(e*t*o);return Math.max(0,e+n)}function A(e){return ve("sha256").update(e).digest("hex")}function m(e,t){const r=g.test(e)?"[REDACTED]":e;return r.length<=t?r:`${r.slice(0,t)}...[TRUNCATED:${r.length-t}]`}function D(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}function Y(e){return Array.from(new Set(e))}function xe(e){return new Promise(t=>setTimeout(t,e))}export{Ve as DEFAULT_RUNNER_HEARTBEAT_BACKOFF_MS,He as DEFAULT_RUNNER_HEARTBEAT_INTERVAL_MS,Ye as DEFAULT_RUNNER_HEARTBEAT_JITTER_RATIO,Je as DEFAULT_RUNNER_HEARTBEAT_TIMEOUT_MS,d as RUNNER_PORTAL_SYNC_REASON_CODES,Ge as runRunnerPortalHeartbeat,$t as runRunnerPortalHeartbeatLoop,Ze as runRunnerPortalSync,vt as runRunnerPortalSyncLoop};
+/**
+ * @license FSL-1.1
+ * Copyright (c) 2026 OrNexus AI
+ *
+ * P192.02 -- outbound Portal sync worker for runner heartbeat, jobs sync and
+ * pending command acknowledgements.
+ */
+import { createHash } from 'node:crypto';
+import { resolve } from 'node:path';
+import { DEFAULT_SERVER_URL } from '../constants.js';
+import { loadSecureConfig } from '../config/secure-config.js';
+import { LicenseClient } from '../license/license-client.js';
+import { CLIENT_VERSION } from '../version.js';
+import { deriveProjectIdentity } from './project-identity.js';
+import { CONTINUITY_CLIENT_CONTRACT_VERSION, CONTINUITY_CLIENT_PORTAL_SYNC_ENVELOPE_VERSION, CONTINUITY_CLIENT_SCHEMA_VERSION, ContinuityClientStateStore, } from '../continuity/continuity-client-state-store.js';
+import { isContinuityPublicStage, normalizeContinuityStageIteration, openContinuitySqliteStore, sanitizeContinuityStageHistory, } from '../continuity/sqlite-store.js';
+export const RUNNER_PORTAL_SYNC_REASON_CODES = Object.freeze({
+    OK: 'continuity-ok',
+    AUTH_TOKEN_PERMISSION_FAILURE: 'auth-token-permission-failure',
+    BACKOFF_SCHEDULED: 'backoff-scheduled',
+    COMMAND_EXPIRED: 'command-expired',
+    IDEMPOTENCY_REPLAY: 'idempotency-replay',
+    INVALID_STATE_TRANSITION: 'invalid-state-transition',
+    JOB_CANCELLED: 'job-cancelled',
+    PORTAL_COMMAND_LOCAL_AUDIT_RECORDED: 'portal-command-local-audit-recorded',
+    PORTAL_COMMAND_PAYLOAD_REJECTED: 'portal-command-payload-rejected',
+    PORTAL_SYNC_PAYLOAD_REJECTED: 'portal-sync-payload-rejected',
+    RUNNER_DIRECTIVE_UNTRUSTED: 'runner-directive-untrusted',
+    SQLITE_ADAPTER_UNAVAILABLE: 'sqlite-adapter-unavailable',
+    SQLITE_INTEGRITY_FAILED: 'sqlite-integrity-failed',
+    UNSAFE_FIELD_REJECTED: 'unsafe-field-rejected',
+    WAITING_HUMAN: 'waiting-human',
+});
+const REVIEW_GATE_DECISION_OPTIONS = new Set(['approve', 'deny', 'hold']);
+const REVIEW_GATE_DECISION_ALLOWED_KEYS = new Set(['option', 'decisionId', 'gateId', 'publicSafe']);
+export const DEFAULT_RUNNER_HEARTBEAT_INTERVAL_MS = 60_000;
+export const DEFAULT_RUNNER_HEARTBEAT_BACKOFF_MS = 30_000;
+export const DEFAULT_RUNNER_HEARTBEAT_TIMEOUT_MS = 10_000;
+export const DEFAULT_RUNNER_HEARTBEAT_JITTER_RATIO = 0.2;
+const PORTAL_PROCESS_SESSION_SEED = `${Date.now()}:${Math.random().toString(16).slice(2)}`;
+const COMMAND_ACTIONS = new Set(['pause', 'resume', 'cancel', 'run_once', 'retry', 'snapshot', 'approve_review_gate', 'deny_review_gate', 'answer_decision']);
+const COMMAND_ALLOWED_KEYS = new Set([
+    'commandId',
+    'jobId',
+    'action',
+    'decision',
+    'status',
+    'queuedAt',
+    'expiresAt',
+    'acknowledgedAt',
+    'idempotencyKey',
+    'delivery',
+    'workspaceId',
+    'workspaceLabel',
+    'runnerId',
+    'projectId',
+    'projectLabel',
+    'reasonCode',
+    'publicSafe',
+]);
+const SAFE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,159}$/;
+const SAFE_RUNNER_ID_PATTERN = /^runner-[A-Za-z0-9._-]{1,80}$/;
+const SAFE_JOB_ID_PATTERN = /^(?:job|goal|loop|runner)-[A-Za-z0-9._-]{1,80}$/;
+const SAFE_COMMAND_ID_PATTERN = /^pcmd-[a-f0-9]{8,64}$/i;
+const SAFE_REASON_CODE_PATTERN = /^[a-z0-9][a-z0-9-]{1,80}$/;
+const UNSAFE_KEY_PATTERN = /(raw[_-]?(?:logs?|payloads?)|std(?:out|err)|stack(?:[_-]?trace)?|transcript|prompt(?:[_-]?(?:body|text))?|private[_-]?(?:urls?|prompts?)|secret|token|password|protected(?:[_-]?(?:field|body|bodies|internals))?|workflow(?:[_-]?body)?|step(?:[_-]?body)?|customer(?:[_-]?(?:pii|data))?|\bpii\b|authorization|api[_-]?key|license[_-]?key|argv|args|executable(?:[_-]?path)?|binary(?:[_-]?path)?|shell|cwd|command[_-]?path|vendor(?:[_-]?(?:payload|corpus|response|output)))/i;
+const UNSAFE_VALUE_PATTERN = /(https?:\/\/\S+|(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)|ghp_[A-Za-z0-9_]+|sk-[A-Za-z0-9_-]+|-----BEGIN [A-Z ]*PRIVATE KEY-----|authorization\s*:|password\s*=|token\s*=|api[_-]?key\s*=|license[_-]?key\s*=|raw[_-]?(?:logs?)\s*[:=]|transcript|stack\s*trace|stderr:|stdout:|system prompt|workflow body|step body|PROTECTED_|PRIVATE_INTERNALS|CUSTOMER_PII|\bPII\b|VENDOR_CORPUS|P180[_-]?SYNTHETIC[_-]?CONTINUITY|P185[_-]?SYNTHETIC[_-]?CONTINUITY|P187[_-]?SYNTHETIC[_-]?(?:CONTINUITY|RUNNER|WATCH)|P190[_-]?SYNTHETIC[_-]?(?:HEADLESS|CONTINUITY)|P192[_-]?SYNTHETIC[_-]?(?:PORTAL|RUNNER|SYNC))/i;
+const UNSAFE_LABEL_PATTERN = /(?:[;&|`$<>]|\$\(|\n|\r|\0|(?:^|\s)(?:bash|sh|zsh|fish|cmd\.exe|powershell|pwsh|npm|pnpm|yarn|node|python|ruby|go|cargo|sudo|chmod|curl|wget)\s+(?:-c|run|exec|install|test|build|[A-Za-z0-9_./:-]+))/i;
+export async function runRunnerPortalHeartbeat(options = {}) {
+    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const now = options.now ?? (() => new Date().toISOString());
+    const generatedAt = now();
+    const runnerId = sanitizeRunnerId(options.runnerId ?? defaultPortalRunnerId(projectRoot));
+    const sessionId = sanitizeSessionId(options.sessionId) ?? defaultPortalSessionId(projectRoot);
+    const identity = resolveRunnerPortalIdentity(projectRoot, options);
+    const { workspaceId, workspaceLabel, projectId, projectLabel } = identity;
+    const mode = options.mode ?? 'background';
+    const reasonCodes = [];
+    const redactionEvidence = [];
+    const posted = { heartbeat: false };
+    let store;
+    try {
+        store = await openContinuitySqliteStore({
+            projectRoot,
+            adapter: options.adapter,
+            adapterLoader: options.adapterLoader,
+            now,
+        });
+        const clientStateStore = new ContinuityClientStateStore(store, now, deriveProjectIdentity(projectRoot));
+        const snapshot = clientStateStore.collectSnapshot({
+            nowIso: generatedAt,
+            jobLimit: boundedInteger(options.jobLimit ?? 20, 1, 50),
+            dueJobLimit: 20,
+            eventLimit: 1,
+            receiptLimit: 1,
+            staleLeaseLimit: 20,
+            processingSummaryLimit: 1,
+            snapshotLimit: 1,
+        });
+        const authToken = options.httpClient ? options.authToken : await resolveAuthToken(options);
+        const http = options.httpClient ?? defaultPortalHttpClient(resolveServerUrl(options), authToken);
+        const headers = buildPortalHeaders(options.clientVersion ?? CLIENT_VERSION, authToken);
+        const heartbeatBody = buildHeartbeatPayload(snapshot, {
+            runnerId,
+            sessionId,
+            identity,
+            generatedAt,
+            schedulerState: options.schedulerState ?? 'unknown',
+            clientVersion: options.clientVersion ?? CLIENT_VERSION,
+        });
+        const heartbeatResult = await safeHttp(http, {
+            method: 'POST',
+            path: '/api/v1/continuity/runner/heartbeat',
+            body: heartbeatBody,
+            headers,
+        }, { timeoutMs: options.timeoutMs ?? options.heartbeatTimeoutMs ?? DEFAULT_RUNNER_HEARTBEAT_TIMEOUT_MS });
+        if (heartbeatResult.ok)
+            posted.heartbeat = true;
+        else
+            reasonCodes.push(heartbeatResult.reasonCode);
+        const counts = heartbeatCounts(snapshot, redactionEvidence.length);
+        return {
+            ok: posted.heartbeat,
+            runnerId,
+            sessionId,
+            workspaceId,
+            workspaceLabel,
+            projectId,
+            projectLabel,
+            mode,
+            generatedAt,
+            serverAccessToLocalhost: false,
+            serverHeldStream: false,
+            localhostCallback: false,
+            posted,
+            counts,
+            reasonCodes: unique(reasonCodes.length > 0 ? reasonCodes : [RUNNER_PORTAL_SYNC_REASON_CODES.OK]),
+            redactionEvidence,
+            publicSafe: true,
+        };
+    }
+    catch (error) {
+        const reasonCode = classifyPortalSyncError(error);
+        return {
+            ok: false,
+            runnerId,
+            sessionId,
+            workspaceId,
+            workspaceLabel,
+            projectId,
+            projectLabel,
+            mode,
+            generatedAt,
+            serverAccessToLocalhost: false,
+            serverHeldStream: false,
+            localhostCallback: false,
+            posted,
+            counts: { redactions: redactionEvidence.length },
+            reasonCodes: [reasonCode],
+            redactionEvidence,
+            publicSafe: true,
+        };
+    }
+    finally {
+        store?.close();
+    }
+}
+export async function runRunnerPortalSync(options = {}) {
+    const projectRoot = resolve(options.projectRoot ?? process.cwd());
+    const now = options.now ?? (() => new Date().toISOString());
+    const generatedAt = now();
+    const runnerId = sanitizeRunnerId(options.runnerId ?? defaultPortalRunnerId(projectRoot));
+    const sessionId = sanitizeSessionId(options.sessionId) ?? defaultPortalSessionId(projectRoot);
+    const identity = resolveRunnerPortalIdentity(projectRoot, options);
+    const { workspaceId, workspaceLabel, projectId, projectLabel } = identity;
+    const mode = options.mode ?? 'manual';
+    const reasonCodes = [];
+    const redactionEvidence = [];
+    const commandAcks = [];
+    const posted = { heartbeat: false, runnerSync: false, commandAcks: 0 };
+    const commandPoll = { polled: 0, applied: 0, alreadyApplied: 0, rejected: 0, expired: 0, failedLocal: 0 };
+    let store;
+    try {
+        store = await openContinuitySqliteStore({
+            projectRoot,
+            adapter: options.adapter,
+            adapterLoader: options.adapterLoader,
+            now,
+        });
+        const retention = store.compactPublicReceiptsAndOutputs({
+            nowIso: generatedAt,
+            policy: options.retentionPolicy,
+        });
+        const clientStateStore = new ContinuityClientStateStore(store, now, deriveProjectIdentity(projectRoot));
+        const snapshot = clientStateStore.collectSnapshot({
+            nowIso: generatedAt,
+            jobLimit: boundedInteger(options.jobLimit ?? 50, 1, 50),
+            dueJobLimit: 50,
+            eventLimit: boundedInteger(options.eventLimit ?? 50, 1, 100),
+            receiptLimit: boundedInteger(options.receiptLimit ?? 50, 1, 100),
+            staleLeaseLimit: 20,
+            processingSummaryLimit: 20,
+            snapshotLimit: 10,
+        });
+        const syncCursor = buildSyncCursor(snapshot, generatedAt);
+        const http = options.httpClient ?? defaultPortalHttpClient(resolveServerUrl(options), await resolveAuthToken(options));
+        const headers = buildPortalHeaders(options.clientVersion ?? CLIENT_VERSION, options.httpClient ? options.authToken : await resolveAuthToken(options));
+        const heartbeatBody = buildHeartbeatPayload(snapshot, { runnerId, sessionId, identity, generatedAt, schedulerState: options.schedulerState ?? 'unknown', clientVersion: options.clientVersion ?? CLIENT_VERSION });
+        const heartbeatResult = await safeHttp(http, {
+            method: 'POST',
+            path: '/api/v1/continuity/runner/heartbeat',
+            body: heartbeatBody,
+            headers,
+        });
+        if (heartbeatResult.ok)
+            posted.heartbeat = true;
+        else
+            reasonCodes.push(heartbeatResult.reasonCode);
+        const runnerSyncBody = buildRunnerSyncPayload(snapshot, {
+            runnerId,
+            identity,
+            generatedAt,
+            previousSyncCursor: options.syncCursor,
+            nextSyncCursor: syncCursor,
+            heartbeat: heartbeatBody,
+        });
+        const outboxDelivery = enqueueRunnerSyncOutboxDelivery(store, snapshot, {
+            runnerId,
+            identity,
+            generatedAt,
+            previousSyncCursor: options.syncCursor,
+            nextSyncCursor: syncCursor,
+        });
+        const runnerSyncResult = outboxDelivery.status === 'acked' && outboxDelivery.replay
+            ? { ok: true, body: { reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.IDEMPOTENCY_REPLAY, publicSafe: true } }
+            : outboxDelivery.status === 'conflict' || outboxDelivery.status === 'dead_letter'
+                ? { ok: false, reasonCode: outboxDelivery.reasonCode ?? RUNNER_PORTAL_SYNC_REASON_CODES.BACKOFF_SCHEDULED }
+                : await safeHttp(http, {
+                    method: 'POST',
+                    path: '/api/v1/continuity/jobs/sync',
+                    body: runnerSyncBody,
+                    headers,
+                });
+        if (runnerSyncResult.ok) {
+            posted.runnerSync = true;
+            store.ackOutbox({
+                outboxId: outboxDelivery.outboxId,
+                deliveryCursor: outboxDelivery.deliveryCursor,
+                ackedAt: now(),
+                reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.OK,
+            });
+        }
+        else {
+            reasonCodes.push(runnerSyncResult.reasonCode);
+            store.failOutboxDelivery({
+                outboxId: outboxDelivery.outboxId,
+                deliveryCursor: outboxDelivery.deliveryCursor,
+                failedAt: now(),
+                reasonCode: runnerSyncResult.reasonCode,
+                summary: 'Runner sync delivery failed with a public reason code and will retry or dead-letter by policy.',
+                policy: { maxAttempts: 3 },
+            });
+        }
+        const commandResponse = await safeHttp(http, {
+            method: 'GET',
+            path: '/api/v1/continuity/runner/commands',
+            query: { runnerId, workspaceId, workspaceLabel, projectId, projectLabel },
+            headers,
+        });
+        if (commandResponse.ok) {
+            const commands = extractPendingCommands(commandResponse.body).slice(0, boundedInteger(options.commandLimit ?? 20, 1, 20));
+            commandPoll.polled = commands.length;
+            for (const rawCommand of commands) {
+                const ack = await applyAndAcknowledgeCommand({
+                    store,
+                    http,
+                    headers,
+                    rawCommand,
+                    runnerId,
+                    identity,
+                    nowIso: now(),
+                });
+                commandAcks.push(ack);
+                posted.commandAcks += 1;
+                if (ack.localStatus === 'applied')
+                    commandPoll.applied += 1;
+                else if (ack.localStatus === 'already_applied')
+                    commandPoll.alreadyApplied += 1;
+                else if (ack.localStatus === 'rejected')
+                    commandPoll.rejected += 1;
+                else if (ack.localStatus === 'expired')
+                    commandPoll.expired += 1;
+                else
+                    commandPoll.failedLocal += 1;
+                redactionEvidence.push(...ack.redactionEvidence);
+                reasonCodes.push(ack.reasonCode);
+            }
+        }
+        else {
+            reasonCodes.push(commandResponse.reasonCode);
+        }
+        const counts = {
+            jobs: snapshot.counts.jobs ?? snapshot.jobs.length,
+            dueJobs: snapshot.dueJobCount,
+            receipts: snapshot.counts.receipts ?? snapshot.lastReceipts.length,
+            events: snapshot.counts.events ?? snapshot.lastEvents.length,
+            commandsPolled: commandPoll.polled,
+            commandAcks: posted.commandAcks,
+            commandApplied: commandPoll.applied,
+            commandAlreadyApplied: commandPoll.alreadyApplied,
+            commandRejected: commandPoll.rejected,
+            commandExpired: commandPoll.expired,
+            commandFailedLocal: commandPoll.failedLocal,
+            receiptCompactionSummaries: retention.counts.summariesCreated,
+            receiptsCompacted: retention.counts.receiptsRemoved,
+            processingSummariesCompacted: retention.counts.outputsRemoved,
+            redactions: redactionEvidence.length,
+            ...queueCounts(snapshot),
+        };
+        const finalReasonCodes = unique(reasonCodes.length > 0 ? reasonCodes : [RUNNER_PORTAL_SYNC_REASON_CODES.OK]);
+        return {
+            ok: posted.heartbeat && posted.runnerSync && commandPoll.failedLocal === 0,
+            runnerId,
+            sessionId,
+            workspaceId,
+            workspaceLabel,
+            projectId,
+            projectLabel,
+            mode,
+            generatedAt,
+            serverAccessToLocalhost: false,
+            serverHeldStream: false,
+            localhostCallback: false,
+            posted,
+            commandPoll,
+            sync: {
+                ...(options.syncCursor ? { previousSyncCursor: options.syncCursor } : {}),
+                nextSyncCursor: syncCursor,
+                counts,
+            },
+            commandAcks,
+            reasonCodes: finalReasonCodes,
+            redactionEvidence: redactionEvidence.slice(0, 50),
+            publicSafe: true,
+        };
+    }
+    catch (error) {
+        const reasonCode = classifyPortalSyncError(error);
+        return {
+            ok: false,
+            runnerId,
+            sessionId,
+            workspaceId,
+            workspaceLabel,
+            projectId,
+            projectLabel,
+            mode,
+            generatedAt,
+            serverAccessToLocalhost: false,
+            serverHeldStream: false,
+            localhostCallback: false,
+            posted,
+            commandPoll,
+            sync: { nextSyncCursor: `sync-${sha256Hex(generatedAt).slice(0, 24)}`, counts: { commandAcks: 0 } },
+            commandAcks,
+            reasonCodes: [reasonCode],
+            redactionEvidence,
+            publicSafe: true,
+        };
+    }
+    finally {
+        store?.close();
+    }
+}
+export async function runRunnerPortalSyncLoop(options = {}) {
+    const maxRuns = boundedInteger(options.maxRuns ?? 1, 1, 10_000);
+    const intervalMs = boundedInteger(options.intervalMs ?? 60_000, 0, 24 * 60 * 60 * 1000);
+    const runs = [];
+    let syncCursor = options.syncCursor;
+    for (let index = 0; index < maxRuns; index++) {
+        const run = await runRunnerPortalSync({ ...options, mode: options.mode ?? 'background', syncCursor });
+        runs.push(run);
+        syncCursor = run.sync.nextSyncCursor;
+        if (index < maxRuns - 1 && intervalMs > 0)
+            await sleep(intervalMs);
+    }
+    return {
+        ok: runs.every((run) => run.ok),
+        runs,
+        reasonCodes: unique(runs.flatMap((run) => run.reasonCodes)),
+        publicSafe: true,
+    };
+}
+export async function runRunnerPortalHeartbeatLoop(options = {}) {
+    const maxRuns = boundedInteger(options.maxRuns ?? 1, 1, 10_000);
+    const intervalMs = boundedInteger(options.intervalMs ?? DEFAULT_RUNNER_HEARTBEAT_INTERVAL_MS, 0, 24 * 60 * 60 * 1000);
+    const backoffMs = boundedInteger(options.backoffMs ?? DEFAULT_RUNNER_HEARTBEAT_BACKOFF_MS, 1_000, 30 * 60 * 1000);
+    const jitterRatio = boundedNumber(options.jitterRatio ?? DEFAULT_RUNNER_HEARTBEAT_JITTER_RATIO, 0, 0.5);
+    const random = options.random ?? Math.random;
+    const runs = [];
+    for (let index = 0; index < maxRuns; index++) {
+        const run = await runRunnerPortalHeartbeat({ ...options, mode: options.mode ?? 'background' });
+        runs.push(run);
+        if (index < maxRuns - 1) {
+            const baseDelayMs = run.ok ? intervalMs : backoffMs;
+            const delayMs = jitteredDelayMs(baseDelayMs, jitterRatio, random);
+            if (delayMs > 0)
+                await sleep(delayMs);
+        }
+    }
+    return {
+        ok: runs.every((run) => run.ok),
+        runs,
+        reasonCodes: unique(runs.flatMap((run) => run.reasonCodes)),
+        schedule: { intervalMs, backoffMs, jitterRatio, maxRuns },
+        publicSafe: true,
+    };
+}
+async function applyAndAcknowledgeCommand(input) {
+    const validation = validatePendingCommand(input.rawCommand);
+    if (!validation.ok || !validation.command) {
+        recordRejectedCommandAuditIfPossible(input.store, validation, input.runnerId, input.nowIso);
+        return postCommandAck(input.http, input.headers, {
+            commandId: validation.commandId ?? `pcmd-${sha256Hex('invalid-command').slice(0, 16)}`,
+            jobId: validation.jobId,
+            action: validation.action,
+            runnerId: input.runnerId,
+            identity: input.identity,
+            idempotencyKey: `invalid:${validation.commandId ?? 'unknown'}`,
+            localStatus: 'rejected',
+            remoteStatus: 'rejected',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.PORTAL_COMMAND_PAYLOAD_REJECTED,
+            publicSummary: 'Runner rejected unsafe Portal command before local application.',
+            acknowledgedAt: input.nowIso,
+            redactionEvidence: validation.redactions,
+            counts: { rejected: 1, redactions: validation.redactions.length },
+        });
+    }
+    const command = validation.command;
+    const operationId = operationIdForCommand(command.commandId);
+    const baseAck = {
+        commandId: command.commandId,
+        jobId: command.jobId,
+        action: command.action,
+        runnerId: input.runnerId,
+        identity: input.identity,
+        idempotencyKey: command.idempotencyKey,
+        acknowledgedAt: input.nowIso,
+        redactionEvidence: validation.redactions,
+    };
+    if (command.expiresAt && Date.parse(command.expiresAt) <= Date.parse(input.nowIso)) {
+        recordCommandReceiptIfPossible(input.store, command, {
+            operationId,
+            status: 'ignored',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.COMMAND_EXPIRED,
+            createdAt: input.nowIso,
+            summary: 'Portal command expired before local application.',
+            redactionEvidence: validation.redactions,
+        });
+        return postCommandAck(input.http, input.headers, {
+            ...baseAck,
+            localStatus: 'expired',
+            remoteStatus: 'expired',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.COMMAND_EXPIRED,
+            publicSummary: 'Runner skipped expired Portal command.',
+            counts: { expired: 1 },
+        });
+    }
+    if (input.store.hasOperationRef(operationId, command.idempotencyKey)) {
+        recordCommandReplayAuditIfPossible(input.store, command, operationId, input.runnerId, input.nowIso, validation.redactions);
+        return postCommandAck(input.http, input.headers, {
+            ...baseAck,
+            localStatus: 'already_applied',
+            remoteStatus: 'applied',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.IDEMPOTENCY_REPLAY,
+            publicSummary: 'Runner already applied Portal command; duplicate poll was acknowledged without local mutation.',
+            counts: { alreadyApplied: 1 },
+        });
+    }
+    if (!input.store.jobExists(command.jobId)) {
+        return postCommandAck(input.http, input.headers, {
+            ...baseAck,
+            localStatus: 'failed-local',
+            remoteStatus: 'rejected',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.INVALID_STATE_TRANSITION,
+            publicSummary: 'Runner could not find the public job for Portal command application.',
+            counts: { failedLocal: 1 },
+        });
+    }
+    try {
+        const appliedReasonCode = reasonCodeForCommand(command);
+        input.store.runInTransaction(() => {
+            applyLocalCommand(input.store, command, input.nowIso);
+            input.store.appendEvent({
+                eventId: `${operationId}:event`,
+                jobId: command.jobId,
+                operationId,
+                idempotencyKey: command.idempotencyKey,
+                type: 'portal_command_applied',
+                summary: `Portal command ${command.action} applied locally by runner.`,
+                reasonCode: appliedReasonCode,
+                createdAt: input.nowIso,
+                metadata: commandPublicMetadata(command, operationId, input.runnerId, 'applied', input.nowIso, validation.redactions, appliedReasonCode),
+            });
+            input.store.appendReceipt({
+                receiptId: `receipt-${operationId}`,
+                jobId: command.jobId,
+                operationId,
+                idempotencyKey: command.idempotencyKey,
+                status: 'applied',
+                reasonCode: appliedReasonCode,
+                appliedOperationIds: [operationId],
+                createdAt: input.nowIso,
+                metadata: commandPublicMetadata(command, operationId, input.runnerId, 'applied', input.nowIso, validation.redactions, appliedReasonCode),
+            });
+        });
+        return postCommandAck(input.http, input.headers, {
+            ...baseAck,
+            localStatus: 'applied',
+            remoteStatus: 'applied',
+            reasonCode: appliedReasonCode,
+            publicSummary: `Runner applied Portal command ${command.action} locally.`,
+            counts: { applied: 1 },
+        });
+    }
+    catch {
+        recordCommandReceiptIfPossible(input.store, command, {
+            operationId,
+            status: 'failed',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.INVALID_STATE_TRANSITION,
+            createdAt: input.nowIso,
+            summary: 'Portal command failed local application with public reason code.',
+            redactionEvidence: validation.redactions,
+        });
+        return postCommandAck(input.http, input.headers, {
+            ...baseAck,
+            localStatus: 'failed-local',
+            remoteStatus: 'rejected',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.INVALID_STATE_TRANSITION,
+            publicSummary: 'Runner failed local Portal command application with public reason code.',
+            counts: { failedLocal: 1 },
+        });
+    }
+}
+function applyLocalCommand(store, command, nowIso) {
+    switch (command.action) {
+        case 'pause':
+            store.updateJobAndExistingGoalCampaignStatus({ jobId: command.jobId, status: 'paused', updatedAt: nowIso, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.WAITING_HUMAN });
+            return;
+        case 'resume':
+        case 'approve_review_gate':
+            store.updateJobAndExistingGoalCampaignStatus({ jobId: command.jobId, status: 'active', updatedAt: nowIso, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.OK });
+            return;
+        case 'cancel':
+        case 'deny_review_gate':
+            store.updateJobAndExistingGoalCampaignStatus({ jobId: command.jobId, status: 'cancelled', updatedAt: nowIso, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.JOB_CANCELLED });
+            return;
+        case 'answer_decision':
+            if (command.decision?.option === 'approve') {
+                store.updateJobAndExistingGoalCampaignStatus({ jobId: command.jobId, status: 'active', updatedAt: nowIso, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.OK });
+                return;
+            }
+            if (command.decision?.option === 'deny') {
+                store.updateJobAndExistingGoalCampaignStatus({ jobId: command.jobId, status: 'cancelled', updatedAt: nowIso, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.JOB_CANCELLED });
+                return;
+            }
+            if (command.decision?.option === 'hold') {
+                store.updateJobAndExistingGoalCampaignStatus({ jobId: command.jobId, status: 'blocked', updatedAt: nowIso, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.WAITING_HUMAN });
+                return;
+            }
+            throw new Error('unsupported-review-gate-decision');
+        case 'run_once':
+        case 'retry':
+            store.scheduleNextTick({ jobId: command.jobId, scheduledAt: nowIso, updatedAt: nowIso, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.OK });
+            return;
+        case 'snapshot':
+            store.recordStateSnapshot({
+                snapshotId: `snapshot-${operationIdForCommand(command.commandId)}`,
+                jobId: command.jobId,
+                kind: 'portal_command_snapshot',
+                summary: 'Portal snapshot command recorded public local state checkpoint request.',
+                capturedAt: nowIso,
+                operationId: operationIdForCommand(command.commandId),
+                idempotencyKey: command.idempotencyKey,
+                metadata: commandPublicMetadata(command, operationIdForCommand(command.commandId), command.runnerId, 'applied', nowIso, [], RUNNER_PORTAL_SYNC_REASON_CODES.OK),
+            });
+            return;
+        default:
+            throw new Error('unsupported-command-action');
+    }
+}
+async function postCommandAck(http, headers, input) {
+    await safeHttp(http, {
+        method: 'POST',
+        path: `/api/v1/continuity/runner/commands/${encodeURIComponent(input.commandId)}/ack`,
+        body: {
+            status: input.remoteStatus,
+            runnerId: input.runnerId,
+            workspaceId: input.identity.workspaceId,
+            workspaceLabel: input.identity.workspaceLabel,
+            projectId: input.identity.projectId,
+            projectLabel: input.identity.projectLabel,
+            idempotencyKey: input.idempotencyKey,
+            reasonCode: input.reasonCode,
+            publicSummary: boundPublicText(input.publicSummary, 280),
+            counts: filterFiniteCounts(input.counts),
+            redactionEvidence: input.redactionEvidence.slice(0, 20),
+            publicSafe: true,
+        },
+        headers,
+    });
+    return {
+        commandId: input.commandId,
+        ...(input.jobId ? { jobId: input.jobId } : {}),
+        workspaceId: input.identity.workspaceId,
+        workspaceLabel: input.identity.workspaceLabel,
+        projectId: input.identity.projectId,
+        projectLabel: input.identity.projectLabel,
+        ...(input.action ? { action: input.action } : {}),
+        localStatus: input.localStatus,
+        remoteStatus: input.remoteStatus,
+        reasonCode: input.reasonCode,
+        publicSummary: boundPublicText(input.publicSummary, 280),
+        acknowledgedAt: input.acknowledgedAt,
+        counts: input.counts,
+        redactionEvidence: input.redactionEvidence.slice(0, 20),
+        publicSafe: true,
+    };
+}
+function recordCommandReceiptIfPossible(store, command, input) {
+    try {
+        if (!store.jobExists(command.jobId) || store.hasOperationRef(input.operationId, command.idempotencyKey))
+            return;
+        store.appendReceipt({
+            receiptId: `receipt-${input.operationId}`,
+            jobId: command.jobId,
+            operationId: input.operationId,
+            idempotencyKey: command.idempotencyKey,
+            status: input.status,
+            reasonCode: input.reasonCode,
+            ignoredOperationIds: [input.operationId],
+            createdAt: input.createdAt,
+            metadata: commandPublicMetadata(command, input.operationId, command.runnerId, input.status, input.createdAt, input.redactionEvidence, input.reasonCode),
+        });
+        store.appendEvent({
+            eventId: `${input.operationId}:event`,
+            jobId: command.jobId,
+            operationId: `${input.operationId}:event`,
+            idempotencyKey: `${command.idempotencyKey}:event`,
+            type: input.status === 'failed' ? 'portal_command_failed' : 'portal_command_rejected',
+            summary: input.summary,
+            reasonCode: input.reasonCode,
+            createdAt: input.createdAt,
+            metadata: commandPublicMetadata(command, input.operationId, command.runnerId, input.status, input.createdAt, input.redactionEvidence, input.reasonCode),
+        });
+    }
+    catch {
+        // Acknowledgement still proceeds with a public failed-local/rejected reason.
+    }
+}
+function recordRejectedCommandAuditIfPossible(store, validation, runnerId, nowIso) {
+    if (!validation.commandId || !SAFE_COMMAND_ID_PATTERN.test(validation.commandId))
+        return;
+    if (!validation.jobId || !isSafePublicJobId(validation.jobId))
+        return;
+    if (!validation.action || !COMMAND_ACTIONS.has(validation.action))
+        return;
+    const command = {
+        commandId: validation.commandId,
+        jobId: validation.jobId,
+        action: validation.action,
+        status: 'queued',
+        queuedAt: nowIso,
+        idempotencyKey: `rejected:${validation.commandId}`,
+        delivery: 'runner_poll',
+        runnerId,
+        reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.PORTAL_COMMAND_PAYLOAD_REJECTED,
+        publicSafe: true,
+    };
+    recordCommandReceiptIfPossible(store, command, {
+        operationId: `${operationIdForCommand(validation.commandId)}:rejected`,
+        status: 'ignored',
+        reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.PORTAL_COMMAND_PAYLOAD_REJECTED,
+        createdAt: nowIso,
+        summary: 'Runner rejected unsafe Portal command before local application.',
+        redactionEvidence: validation.redactions,
+    });
+}
+function recordCommandReplayAuditIfPossible(store, command, operationId, runnerId, nowIso, redactions) {
+    const replayOperationId = `${operationId}:replay`;
+    try {
+        if (!store.jobExists(command.jobId) || store.hasOperationRef(replayOperationId, `${command.idempotencyKey}:replay`))
+            return;
+        store.appendEvent({
+            eventId: `${replayOperationId}:event`,
+            jobId: command.jobId,
+            operationId: replayOperationId,
+            idempotencyKey: `${command.idempotencyKey}:replay`,
+            type: 'portal_command_replay',
+            summary: 'Runner recorded idempotent Portal command replay without local mutation.',
+            reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.IDEMPOTENCY_REPLAY,
+            createdAt: nowIso,
+            metadata: commandPublicMetadata(command, replayOperationId, runnerId, 'already_applied', nowIso, redactions, RUNNER_PORTAL_SYNC_REASON_CODES.IDEMPOTENCY_REPLAY),
+        });
+    }
+    catch {
+        // Replay acknowledgement still proceeds; local replay audit is best-effort public evidence.
+    }
+}
+function buildHeartbeatPayload(snapshot, input) {
+    const status = runnerStatus(snapshot);
+    const activeJobIds = snapshot.jobs
+        .filter((job) => ['planned', 'active', 'running', 'backoff', 'waiting_external', 'waiting_human'].includes(job.status))
+        .map((job) => job.jobId)
+        .filter(isSafePublicJobId)
+        .slice(0, 20);
+    const leaseIds = snapshot.staleLeases.map((lease) => lease.leaseId).filter(isSafePublicId).slice(0, 20);
+    const nextTickAt = minIso(snapshot.dueJobs.map((job) => job.nextRunAt).filter((value) => Boolean(value)));
+    return {
+        schemaVersion: CONTINUITY_CLIENT_SCHEMA_VERSION,
+        contractVersion: CONTINUITY_CLIENT_CONTRACT_VERSION,
+        runnerId: input.runnerId,
+        ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+        workspaceId: input.identity.workspaceId,
+        workspaceLabel: input.identity.workspaceLabel,
+        projectId: input.identity.projectId,
+        projectLabel: input.identity.projectLabel,
+        status,
+        observedAt: input.generatedAt,
+        version: boundPublicText(input.clientVersion, 80),
+        activeJobIds,
+        leaseIds,
+        ...(nextTickAt ? { nextTickAt } : {}),
+        schedulerState: input.schedulerState,
+        doctorSummary: status === 'degraded'
+            ? 'Runner sync is degraded by public stale lease or retryable outbox counts.'
+            : 'Runner sync heartbeat contains public local continuity summaries.',
+        reasonCode: status === 'degraded' ? RUNNER_PORTAL_SYNC_REASON_CODES.BACKOFF_SCHEDULED : RUNNER_PORTAL_SYNC_REASON_CODES.OK,
+        queue: {
+            depth: snapshot.queue.depth,
+            queued: snapshot.queue.queued,
+            running: snapshot.queue.running,
+            retrying: snapshot.queue.retrying,
+            deadLetter: snapshot.queue.deadLetter,
+            capacity: snapshot.queue.capacity,
+            available: snapshot.queue.available,
+            backpressure: snapshot.queue.backpressure,
+            generatedAt: snapshot.queue.generatedAt,
+            ...(snapshot.queue.nextRetryAt ? { nextRetryAt: snapshot.queue.nextRetryAt } : {}),
+            ...(snapshot.queue.reasonCode ? { reasonCode: safeReasonCode(snapshot.queue.reasonCode) } : {}),
+            publicSafe: true,
+        },
+        metadata: {
+            schemaVersion: CONTINUITY_CLIENT_SCHEMA_VERSION,
+            contractVersion: CONTINUITY_CLIENT_CONTRACT_VERSION,
+            transportKind: 'runner_heartbeat',
+            ...(input.sessionId ? { sessionId: input.sessionId } : {}),
+            workspaceId: input.identity.workspaceId,
+            workspaceLabel: input.identity.workspaceLabel,
+            projectId: input.identity.projectId,
+            projectLabel: input.identity.projectLabel,
+            observedAt: input.generatedAt,
+            serverAccessToLocalhost: false,
+            serverHeldStream: false,
+            counts: {
+                jobs: snapshot.counts.jobs ?? snapshot.jobs.length,
+                dueJobs: snapshot.dueJobCount,
+                activeLeases: snapshot.counts.activeLeases ?? 0,
+                staleLeases: snapshot.counts.staleLeases ?? snapshot.staleLeases.length,
+                outboxPending: snapshot.outbox.pending ?? 0,
+                outboxFailed: (snapshot.outbox.failed ?? 0) + (snapshot.outbox.deadLetter ?? 0),
+                ...queueCounts(snapshot),
+            },
+            reasonCodes: [status === 'degraded' ? RUNNER_PORTAL_SYNC_REASON_CODES.BACKOFF_SCHEDULED : RUNNER_PORTAL_SYNC_REASON_CODES.OK],
+            publicSummary: 'Runner heartbeat generated from local continuity SQLite public summaries.',
+        },
+        publicSafe: true,
+    };
+}
+function buildRunnerSyncPayload(snapshot, input) {
+    const jobs = snapshot.jobs.map((job) => toPortalJobSync(job, input.identity, snapshot)).slice(0, 50);
+    const events = [
+        ...snapshot.lastEvents.map(toPortalEventSync),
+        ...(snapshot.headlessExecutionAttempts ?? []).map(toPortalHeadlessExecutionEventSync),
+    ].slice(0, 100);
+    const receipts = snapshot.lastReceipts.map(toPortalReceiptSync).slice(0, 100);
+    const outbox = outboxSummaries(snapshot, input.generatedAt);
+    return {
+        runnerId: input.runnerId,
+        workspaceId: input.identity.workspaceId,
+        workspaceLabel: input.identity.workspaceLabel,
+        projectId: input.identity.projectId,
+        projectLabel: input.identity.projectLabel,
+        runner: {
+            ...input.heartbeat,
+            metadata: {
+                schemaVersion: CONTINUITY_CLIENT_SCHEMA_VERSION,
+                contractVersion: CONTINUITY_CLIENT_CONTRACT_VERSION,
+                syncVersion: CONTINUITY_CLIENT_PORTAL_SYNC_ENVELOPE_VERSION,
+                transportKind: 'runner_sync',
+                workspaceId: input.identity.workspaceId,
+                workspaceLabel: input.identity.workspaceLabel,
+                projectId: input.identity.projectId,
+                projectLabel: input.identity.projectLabel,
+                syncCursor: input.previousSyncCursor ?? 'sync-initial',
+                nextSyncCursor: input.nextSyncCursor,
+                generatedAt: input.generatedAt,
+                serverAccessToLocalhost: false,
+                serverHeldStream: false,
+                counts: {
+                    jobs: jobs.length,
+                    events: events.length,
+                    receipts: receipts.length,
+                    outbox: outbox.length,
+                    headlessExecutionAttempts: snapshot.headlessExecutionAttempts?.length ?? 0,
+                    ...queueCounts(snapshot),
+                },
+                publicSummary: 'Runner sync uploaded public job, event and receipt summaries.',
+            },
+        },
+        jobs,
+        events,
+        receipts,
+        outbox,
+        runnerSync: {
+            runnerId: input.runnerId,
+            workspaceId: input.identity.workspaceId,
+            workspaceLabel: input.identity.workspaceLabel,
+            projectId: input.identity.projectId,
+            projectLabel: input.identity.projectLabel,
+            syncCursor: input.previousSyncCursor ?? 'sync-initial',
+            nextSyncCursor: input.nextSyncCursor,
+            generatedAt: input.generatedAt,
+            publicSummary: 'Runner sync uploaded public job, event and receipt summaries.',
+            counts: {
+                jobs: jobs.length,
+                events: events.length,
+                receipts: receipts.length,
+                outbox: outbox.length,
+                ...queueCounts(snapshot),
+            },
+            publicSafe: true,
+        },
+    };
+}
+function enqueueRunnerSyncOutboxDelivery(store, snapshot, input) {
+    const outboxId = runnerSyncOutboxId({ runnerId: input.runnerId, workspaceId: input.identity.workspaceId, projectId: input.identity.projectId, nextSyncCursor: input.nextSyncCursor });
+    const deliveryCursor = runnerSyncDeliveryCursor({ runnerId: input.runnerId, workspaceId: input.identity.workspaceId, projectId: input.identity.projectId, nextSyncCursor: input.nextSyncCursor });
+    store.enqueueOutbox({
+        outboxId,
+        jobId: firstSafeJobId(snapshot),
+        operationId: `op-${outboxId}`,
+        idempotencyKey: `idem-${outboxId}`,
+        type: 'runner_sync',
+        status: 'pending',
+        payload: runnerSyncOutboxPayload(snapshot, input),
+        createdAt: input.generatedAt,
+        updatedAt: input.generatedAt,
+    });
+    return store.markOutboxSent({
+        outboxId,
+        deliveryCursor,
+        sentAt: input.generatedAt,
+        reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.OK,
+    });
+}
+function runnerSyncOutboxId(input) {
+    return `outbox-runner-sync-${sha256Hex(`${input.runnerId}:${input.workspaceId}:${input.projectId ?? 'project'}:${input.nextSyncCursor}`).slice(0, 32)}`;
+}
+function runnerSyncDeliveryCursor(input) {
+    return `cursor-runner-sync-${sha256Hex(`${input.workspaceId}:${input.projectId ?? 'project'}:${input.runnerId}:${input.nextSyncCursor}`).slice(0, 32)}`;
+}
+function runnerSyncOutboxPayload(snapshot, input) {
+    return {
+        schemaVersion: CONTINUITY_CLIENT_SCHEMA_VERSION,
+        contractVersion: CONTINUITY_CLIENT_CONTRACT_VERSION,
+        syncVersion: CONTINUITY_CLIENT_PORTAL_SYNC_ENVELOPE_VERSION,
+        transportKind: 'runner_sync',
+        envelopeId: `runner-sync-${sha256Hex(`${input.runnerId}:${input.nextSyncCursor}`).slice(0, 24)}`,
+        runnerId: input.runnerId,
+        workspaceId: input.identity.workspaceId,
+        workspaceLabel: input.identity.workspaceLabel,
+        projectId: input.identity.projectId,
+        projectLabel: input.identity.projectLabel,
+        syncCursor: input.previousSyncCursor ?? 'sync-initial',
+        nextSyncCursor: input.nextSyncCursor,
+        generatedAt: input.generatedAt,
+        serverAccessToLocalhost: false,
+        serverHeldStream: false,
+        counts: {
+            jobs: snapshot.counts.jobs ?? snapshot.jobs.length,
+            events: snapshot.counts.events ?? snapshot.lastEvents.length,
+            receipts: snapshot.counts.receipts ?? snapshot.lastReceipts.length,
+            outboxPending: snapshot.outbox.pending ?? 0,
+            outboxFailed: snapshot.outbox.failed ?? 0,
+            outboxDeadLetter: snapshot.outbox.deadLetter ?? 0,
+            headlessExecutionAttempts: snapshot.headlessExecutionAttempts?.length ?? 0,
+            ...queueCounts(snapshot),
+        },
+        redactionEvidence: [{ field: 'runnerSyncBody', reason: 'unbounded_text', evidence: 'operation-denied', publicSafe: true }],
+        publicSummary: 'Runner sync outbox stores public IDs, counts, redaction evidence and cursor state only.',
+    };
+}
+function firstSafeJobId(snapshot) {
+    return snapshot.jobs.map((job) => job.jobId).find(isSafePublicJobId);
+}
+function toPortalJobSync(job, identity, snapshot) {
+    // P195.04: carry the additive stage projection into the legacy `jobs[]` sync
+    // row. Values are re-validated against the public stage allow-list and the
+    // bounded history cap; server-side field gating remains P195.05.
+    const currentStage = isContinuityPublicStage(job.currentStage) ? job.currentStage : undefined;
+    const stageHistory = sanitizeContinuityStageHistory(job.stageHistory);
+    const iteration = normalizeContinuityStageIteration(job.iteration);
+    const operations = jobOperationsSummary(job.jobId, snapshot);
+    return {
+        jobId: job.jobId,
+        workspaceId: identity.workspaceId,
+        workspaceLabel: identity.workspaceLabel,
+        projectId: identity.projectId,
+        projectLabel: identity.projectLabel,
+        kind: safeJobKind(job.kind),
+        status: safeJobStatus(job.status),
+        publicSummary: boundPublicText(job.publicSummary, 240),
+        updatedAt: job.updatedAt,
+        ...(job.nextRunAt ? { nextRunAt: job.nextRunAt } : {}),
+        ...(job.reasonCode ? { reasonCode: safeReasonCode(job.reasonCode) } : {}),
+        ...(job.counts ? { counts: filterFiniteCounts(job.counts) } : {}),
+        ...(operations ? { operations } : {}),
+        ...(currentStage ? { currentStage } : {}),
+        ...(stageHistory.length > 0 ? { stageHistory } : {}),
+        ...(iteration !== undefined ? { iteration } : {}),
+        publicSafe: true,
+    };
+}
+function jobOperationsSummary(jobId, snapshot) {
+    const attempts = (snapshot.headlessExecutionAttempts ?? []).filter((attempt) => attempt.jobId === jobId).slice(0, 50);
+    const staleLeases = snapshot.staleLeases.filter((lease) => lease.jobId === jobId).slice(0, 50);
+    if (attempts.length === 0 && staleLeases.length === 0)
+        return undefined;
+    const retrying = attempts.filter((attempt) => attempt.status === 'backoff' || (attempt.retryCount > 0 && Boolean(attempt.nextRetryAt))).length;
+    const deadLetter = attempts.filter((attempt) => Boolean(attempt.deadLetteredAt) || attempt.status === 'dead_letter').length;
+    const queueDepth = attempts.filter((attempt) => ['queued', 'pending', 'backoff'].includes(attempt.status)).length;
+    const nextRetryAt = minIso(attempts.map((attempt) => attempt.nextRetryAt).filter((value) => Boolean(value)));
+    const latestLeaseExpiresAt = [...attempts]
+        .map((attempt) => attempt.leaseExpiresAt)
+        .filter((value) => Boolean(value))
+        .sort()
+        .at(-1);
+    return {
+        attempts: attempts.length,
+        retries: attempts.reduce((total, attempt) => total + Math.max(0, Math.trunc(attempt.retryCount)), 0),
+        retrying,
+        deadLetter,
+        activeLeases: attempts.filter((attempt) => Boolean(attempt.leaseId) && attempt.status === 'running').length,
+        staleLeases: staleLeases.length,
+        queueDepth,
+        backpressure: snapshot.queue.backpressure && queueDepth > 0,
+        generatedAt: snapshot.generatedAt,
+        ...(nextRetryAt ? { nextRetryAt } : {}),
+        ...(latestLeaseExpiresAt ? { latestLeaseExpiresAt } : {}),
+        publicSafe: true,
+    };
+}
+function toPortalEventSync(event) {
+    return {
+        eventId: event.eventId,
+        jobId: event.jobId,
+        operationId: event.operationId,
+        type: boundPublicText(event.type, 80),
+        summary: boundPublicText(event.publicSummary, 240),
+        publicSummary: boundPublicText(event.publicSummary, 240),
+        createdAt: event.createdAt,
+        ...(event.metadata ? { metadata: event.metadata } : {}),
+        ...(event.reasonCode ? { reasonCode: safeReasonCode(event.reasonCode) } : {}),
+        publicSafe: true,
+    };
+}
+function toPortalHeadlessExecutionEventSync(attempt) {
+    return {
+        eventId: `headless-${sanitizeId(attempt.attemptId)}`,
+        jobId: attempt.jobId,
+        operationId: attempt.executionId,
+        type: 'headless_execution_attempt',
+        summary: boundPublicText(attempt.publicSummary, 240),
+        publicSummary: boundPublicText(attempt.publicSummary, 240),
+        createdAt: attempt.heartbeatAt ?? attempt.enqueuedAt,
+        ...(attempt.reasonCode ? { reasonCode: safeReasonCode(attempt.reasonCode) } : {}),
+        publicSafe: true,
+    };
+}
+function toPortalReceiptSync(receipt) {
+    return {
+        receiptId: receipt.receiptId,
+        jobId: receipt.jobId,
+        ...(receipt.operationId ? { operationId: receipt.operationId } : {}),
+        status: safeReceiptStatus(receipt.status),
+        summary: `Runner receipt ${receipt.status} for ${receipt.jobId}.`,
+        createdAt: receipt.createdAt,
+        ...(receipt.reasonCode ? { reasonCode: safeReasonCode(receipt.reasonCode) } : {}),
+        publicSafe: true,
+    };
+}
+function outboxSummaries(snapshot, generatedAt) {
+    const entries = [];
+    for (const [status, count] of Object.entries(snapshot.outbox)) {
+        if (status === 'total' || !Number.isFinite(count) || count <= 0)
+            continue;
+        entries.push({
+            outboxId: `outbox-${status}`,
+            operationId: `outbox-${status}-${sha256Hex(generatedAt).slice(0, 12)}`,
+            status: status === 'failed' || status === 'deadLetter' ? 'failed' : status === 'acked' || status === 'sent' ? 'applied' : 'accepted',
+            summary: `Outbox ${status} count ${Math.trunc(count)} synced as public status evidence.`,
+            updatedAt: generatedAt,
+            reasonCode: status === 'failed' || status === 'deadLetter' ? RUNNER_PORTAL_SYNC_REASON_CODES.BACKOFF_SCHEDULED : RUNNER_PORTAL_SYNC_REASON_CODES.OK,
+            counts: { [status]: Math.trunc(count) },
+            publicSafe: true,
+        });
+    }
+    return entries.slice(0, 20);
+}
+function validatePendingCommand(input) {
+    const redactions = [];
+    if (!isRecord(input)) {
+        redactions.push(redaction('command', 'unsafe_key', 'operation-denied'));
+        return { ok: false, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.UNSAFE_FIELD_REJECTED, redactions };
+    }
+    for (const key of Object.keys(input)) {
+        if (!COMMAND_ALLOWED_KEYS.has(key) || UNSAFE_KEY_PATTERN.test(key)) {
+            redactions.push(redaction(`command.${boundPublicText(key, 80)}`, 'unsafe_key', 'key-denied'));
+        }
+    }
+    for (const [key, value] of Object.entries(input)) {
+        if (!COMMAND_ALLOWED_KEYS.has(key))
+            continue;
+        collectUnsafeValueRedactions(value, `command.${key}`, redactions);
+    }
+    const commandId = typeof input.commandId === 'string' ? input.commandId : undefined;
+    const jobId = typeof input.jobId === 'string' ? input.jobId : undefined;
+    const action = typeof input.action === 'string' ? input.action : undefined;
+    const status = typeof input.status === 'string' ? input.status : undefined;
+    const queuedAt = typeof input.queuedAt === 'string' ? input.queuedAt : undefined;
+    const idempotencyKey = typeof input.idempotencyKey === 'string' ? input.idempotencyKey : undefined;
+    const delivery = typeof input.delivery === 'string' ? input.delivery : undefined;
+    if (!commandId || !SAFE_COMMAND_ID_PATTERN.test(commandId))
+        redactions.push(redaction('command.commandId', 'unsafe_key'));
+    if (!jobId || !isSafePublicJobId(jobId))
+        redactions.push(redaction('command.jobId', 'unsafe_key'));
+    if (!action || !COMMAND_ACTIONS.has(action))
+        redactions.push(redaction('command.action', 'unsafe_key'));
+    if (status !== 'queued')
+        redactions.push(redaction('command.status', 'unsafe_key'));
+    const decision = validateReviewGateDecision(input.decision, action, redactions);
+    if (!queuedAt || !Number.isFinite(Date.parse(queuedAt)))
+        redactions.push(redaction('command.queuedAt', 'unsafe_key'));
+    if (!idempotencyKey || !isSafePublicId(idempotencyKey))
+        redactions.push(redaction('command.idempotencyKey', 'unsafe_key'));
+    if (delivery !== 'runner_poll')
+        redactions.push(redaction('command.delivery', 'unsafe_key'));
+    if (input.publicSafe !== true)
+        redactions.push(redaction('command.publicSafe', 'unsafe_key'));
+    if (typeof input.expiresAt === 'string' && !Number.isFinite(Date.parse(input.expiresAt)))
+        redactions.push(redaction('command.expiresAt', 'unsafe_key'));
+    if (typeof input.workspaceId === 'string' && !isSafePublicId(input.workspaceId))
+        redactions.push(redaction('command.workspaceId', 'unsafe_key'));
+    if (typeof input.workspaceLabel === 'string' && !isSafePublicLabel(input.workspaceLabel))
+        redactions.push(redaction('command.workspaceLabel', 'unsafe_key'));
+    if (typeof input.runnerId === 'string' && !SAFE_RUNNER_ID_PATTERN.test(input.runnerId))
+        redactions.push(redaction('command.runnerId', 'unsafe_key'));
+    if (typeof input.projectId === 'string' && !isSafePublicId(input.projectId))
+        redactions.push(redaction('command.projectId', 'unsafe_key'));
+    if (typeof input.projectLabel === 'string' && !isSafePublicLabel(input.projectLabel))
+        redactions.push(redaction('command.projectLabel', 'unsafe_key'));
+    if (typeof input.reasonCode === 'string' && !SAFE_REASON_CODE_PATTERN.test(input.reasonCode))
+        redactions.push(redaction('command.reasonCode', 'unsafe_key'));
+    if (redactions.length > 0 || !commandId || !jobId || !action || !queuedAt || !idempotencyKey || !delivery) {
+        return { ok: false, commandId, jobId, action, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.UNSAFE_FIELD_REJECTED, redactions: uniqueRedactions(redactions) };
+    }
+    return {
+        ok: true,
+        command: {
+            commandId,
+            jobId,
+            action,
+            ...(decision ? { decision } : {}),
+            status: status ?? 'queued',
+            queuedAt,
+            ...(typeof input.expiresAt === 'string' ? { expiresAt: input.expiresAt } : {}),
+            idempotencyKey,
+            delivery: delivery ?? 'runner_poll',
+            ...(typeof input.workspaceId === 'string' ? { workspaceId: input.workspaceId } : {}),
+            ...(typeof input.workspaceLabel === 'string' ? { workspaceLabel: input.workspaceLabel } : {}),
+            ...(typeof input.runnerId === 'string' ? { runnerId: input.runnerId } : {}),
+            ...(typeof input.projectId === 'string' ? { projectId: input.projectId } : {}),
+            ...(typeof input.projectLabel === 'string' ? { projectLabel: input.projectLabel } : {}),
+            ...(typeof input.reasonCode === 'string' ? { reasonCode: input.reasonCode } : {}),
+            publicSafe: true,
+        },
+        reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.OK,
+        redactions: [],
+    };
+}
+function validateReviewGateDecision(value, action, redactions) {
+    if (action !== 'answer_decision' && action !== 'approve_review_gate' && action !== 'deny_review_gate') {
+        if (value !== undefined)
+            redactions.push(redaction('command.decision', 'unsafe_key'));
+        return undefined;
+    }
+    if (value === undefined) {
+        if (action === 'answer_decision')
+            redactions.push(redaction('command.decision', 'unsafe_key'));
+        return undefined;
+    }
+    if (!isRecord(value)) {
+        redactions.push(redaction('command.decision', 'unsafe_key'));
+        return undefined;
+    }
+    for (const key of Object.keys(value)) {
+        if (!REVIEW_GATE_DECISION_ALLOWED_KEYS.has(key) || UNSAFE_KEY_PATTERN.test(key)) {
+            redactions.push(redaction(`command.decision.${boundPublicText(key, 80)}`, 'unsafe_key', 'key-denied'));
+        }
+    }
+    const option = typeof value.option === 'string' ? value.option : undefined;
+    if (!option || !REVIEW_GATE_DECISION_OPTIONS.has(option))
+        redactions.push(redaction('command.decision.option', 'unsafe_key'));
+    if (typeof value.decisionId === 'string' && !isSafePublicId(value.decisionId))
+        redactions.push(redaction('command.decision.decisionId', 'unsafe_key'));
+    if (typeof value.gateId === 'string' && !isSafePublicId(value.gateId))
+        redactions.push(redaction('command.decision.gateId', 'unsafe_key'));
+    if (action === 'approve_review_gate' && option !== 'approve')
+        redactions.push(redaction('command.decision.option', 'unsafe_key'));
+    if (action === 'deny_review_gate' && option !== 'deny')
+        redactions.push(redaction('command.decision.option', 'unsafe_key'));
+    if (!option || !REVIEW_GATE_DECISION_OPTIONS.has(option))
+        return undefined;
+    return {
+        option: option,
+        ...(typeof value.decisionId === 'string' ? { decisionId: value.decisionId } : {}),
+        ...(typeof value.gateId === 'string' ? { gateId: value.gateId } : {}),
+        publicSafe: true,
+    };
+}
+function extractPendingCommands(body) {
+    if (!isRecord(body))
+        return [];
+    return Array.isArray(body.commands) ? body.commands : [];
+}
+function commandPublicMetadata(command, operationId, runnerId, status, timestamp, redactions, reasonCode) {
+    const effectiveReasonCode = reasonCode ?? reasonCodeForCommand(command);
+    const effectiveRunnerId = runnerId ?? command.runnerId;
+    return {
+        schemaVersion: CONTINUITY_CLIENT_SCHEMA_VERSION,
+        contractVersion: CONTINUITY_CLIENT_CONTRACT_VERSION,
+        syncVersion: CONTINUITY_CLIENT_PORTAL_SYNC_ENVELOPE_VERSION,
+        transportKind: 'command_ack',
+        actorType: 'runner',
+        ...(effectiveRunnerId ? { actorId: effectiveRunnerId, runnerId: effectiveRunnerId } : {}),
+        jobId: command.jobId,
+        ...(command.workspaceId ? { workspaceId: command.workspaceId } : {}),
+        ...(command.workspaceLabel ? { workspaceLabel: command.workspaceLabel } : {}),
+        ...(command.projectId ? { projectId: command.projectId } : {}),
+        ...(command.projectLabel ? { projectLabel: command.projectLabel } : {}),
+        operationId,
+        idempotencyKey: command.idempotencyKey,
+        commandId: command.commandId,
+        commandKind: command.action,
+        ...(command.decision ? { decisionOption: command.decision.option } : {}),
+        ...(command.decision?.decisionId ? { decisionId: command.decision.decisionId } : {}),
+        ...(command.decision?.gateId ? { gateId: command.decision.gateId } : {}),
+        commandStatus: status,
+        auditStatus: status,
+        acknowledgedAt: timestamp,
+        reasonCode: effectiveReasonCode,
+        redactionCount: redactions.length,
+        redactionEvidence: redactions.slice(0, 20),
+        counts: { redactions: redactions.length },
+        publicSummary: `Portal command ${command.action} ${status}.`,
+    };
+}
+function operationIdForCommand(commandId) {
+    return `portal-command-${sanitizeId(commandId)}`;
+}
+function reasonCodeForCommand(command) {
+    if (command.action === 'cancel' || command.action === 'deny_review_gate')
+        return RUNNER_PORTAL_SYNC_REASON_CODES.JOB_CANCELLED;
+    if (command.action === 'answer_decision' && command.decision?.option === 'deny')
+        return RUNNER_PORTAL_SYNC_REASON_CODES.JOB_CANCELLED;
+    if (command.action === 'pause')
+        return RUNNER_PORTAL_SYNC_REASON_CODES.WAITING_HUMAN;
+    if (command.action === 'answer_decision' && command.decision?.option === 'hold')
+        return RUNNER_PORTAL_SYNC_REASON_CODES.WAITING_HUMAN;
+    return RUNNER_PORTAL_SYNC_REASON_CODES.OK;
+}
+function runnerStatus(snapshot) {
+    if ((snapshot.counts.staleLeases ?? 0) > 0 || (snapshot.outbox.failed ?? 0) > 0 || (snapshot.outbox.deadLetter ?? 0) > 0 || snapshot.queue.backpressure)
+        return 'degraded';
+    if ((snapshot.counts.activeLeases ?? 0) > 0 || snapshot.dueJobCount > 0 || (snapshot.counts.headlessRunningAttempts ?? 0) > 0)
+        return 'busy';
+    return 'idle';
+}
+function heartbeatCounts(snapshot, redactions) {
+    return {
+        jobs: snapshot.counts.jobs ?? snapshot.jobs.length,
+        dueJobs: snapshot.dueJobCount,
+        activeLeases: snapshot.counts.activeLeases ?? 0,
+        staleLeases: snapshot.counts.staleLeases ?? snapshot.staleLeases.length,
+        headlessRunningAttempts: snapshot.counts.headlessRunningAttempts ?? 0,
+        outboxPending: snapshot.outbox.pending ?? 0,
+        outboxFailed: (snapshot.outbox.failed ?? 0) + (snapshot.outbox.deadLetter ?? 0),
+        redactions,
+        ...queueCounts(snapshot),
+    };
+}
+function queueCounts(snapshot) {
+    return {
+        queueDepth: snapshot.queue.depth,
+        queueQueued: snapshot.queue.queued,
+        queueRunning: snapshot.queue.running,
+        queueRetrying: snapshot.queue.retrying,
+        queueDeadLetter: snapshot.queue.deadLetter,
+        queueCapacity: snapshot.queue.capacity,
+        queueAvailable: snapshot.queue.available,
+        queueBackpressure: snapshot.queue.backpressure ? 1 : 0,
+    };
+}
+function buildSyncCursor(snapshot, generatedAt) {
+    const hash = sha256Hex(JSON.stringify({ generatedAt, counts: snapshot.counts, outbox: snapshot.outbox }));
+    return `sync-${hash.slice(0, 24)}`;
+}
+function resolveRunnerPortalIdentity(projectRoot, options) {
+    const derived = deriveProjectIdentity(projectRoot);
+    const workspaceId = sanitizeId(options.workspaceId ?? derived.workspaceId);
+    const projectId = sanitizeId(options.projectId ?? derived.projectId);
+    const projectLabel = sanitizePublicLabel(options.projectLabel ?? (options.projectId ? undefined : derived.projectLabel), options.projectId ? `Project ${projectId}` : derived.projectLabel);
+    const workspaceLabel = sanitizePublicLabel(options.workspaceLabel ?? (options.workspaceId ? undefined : derived.workspaceLabel), options.workspaceId ? `Workspace ${workspaceId}` : derived.workspaceLabel);
+    return { workspaceId, workspaceLabel, projectId, projectLabel };
+}
+function defaultPortalRunnerId(projectRoot) {
+    return `runner-${sha256Hex(projectRoot).slice(0, 16)}`;
+}
+function defaultPortalSessionId(projectRoot) {
+    return `session-${sha256Hex(`${projectRoot}:${process.pid}:${PORTAL_PROCESS_SESSION_SEED}`).slice(0, 16)}`;
+}
+function sanitizeSessionId(value) {
+    if (!value)
+        return undefined;
+    const safe = sanitizeId(value);
+    return SAFE_ID_PATTERN.test(safe) ? safe.slice(0, 96) : undefined;
+}
+function resolveServerUrl(options) {
+    return (options.serverUrl ?? process.env.NEOCORTEX_SERVER_URL ?? loadSecureConfig()?.serverUrl ?? DEFAULT_SERVER_URL).replace(/\/+$/, '');
+}
+async function resolveAuthToken(options) {
+    if (options.authToken)
+        return options.authToken;
+    if (options.httpClient)
+        return undefined;
+    const serverUrl = resolveServerUrl(options);
+    const licenseKey = options.licenseKey ?? loadSecureConfig()?.licenseKey;
+    if (!licenseKey)
+        return undefined;
+    return await new LicenseClient({ serverUrl, licenseKey, clientVersion: options.clientVersion ?? CLIENT_VERSION }).getToken() ?? undefined;
+}
+function defaultPortalHttpClient(serverUrl, authToken) {
+    return async (request) => {
+        if (!authToken) {
+            return { ok: false, status: 401, body: { reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.AUTH_TOKEN_PERMISSION_FAILURE } };
+        }
+        const url = new URL(`${serverUrl}${request.path}`);
+        for (const [key, value] of Object.entries(request.query ?? {})) {
+            if (value !== undefined)
+                url.searchParams.set(key, value);
+        }
+        const response = await fetch(url, {
+            method: request.method,
+            headers: request.headers,
+            body: request.method === 'POST' ? JSON.stringify(request.body ?? {}) : undefined,
+        });
+        const text = await response.text().catch(() => '');
+        let body;
+        try {
+            body = text ? JSON.parse(text) : undefined;
+        }
+        catch {
+            body = undefined;
+        }
+        return { ok: response.ok, status: response.status, body };
+    };
+}
+function buildPortalHeaders(clientVersion, authToken) {
+    return {
+        'Content-Type': 'application/json',
+        'X-Client-Version': boundPublicText(clientVersion, 80),
+        ...(authToken ? { Authorization: `Bearer ${authToken}` } : {}),
+    };
+}
+async function safeHttp(http, request, options = {}) {
+    try {
+        const timeoutMs = boundedInteger(options.timeoutMs ?? 0, 0, 60_000);
+        const response = timeoutMs > 0 ? await withTimeout(http(request), timeoutMs) : await http(request);
+        if (response.ok)
+            return { ok: true, body: response.body };
+        return { ok: false, reasonCode: reasonCodeFromResponse(response.body, response.status), body: response.body };
+    }
+    catch {
+        return { ok: false, reasonCode: RUNNER_PORTAL_SYNC_REASON_CODES.BACKOFF_SCHEDULED };
+    }
+}
+function reasonCodeFromResponse(body, status) {
+    if (isRecord(body)) {
+        const candidate = typeof body.reasonCode === 'string' ? body.reasonCode : typeof body.error_code === 'string' ? body.error_code.toLowerCase().replaceAll('_', '-') : undefined;
+        if (candidate && SAFE_REASON_CODE_PATTERN.test(candidate))
+            return candidate;
+    }
+    if (status === 401 || status === 403)
+        return RUNNER_PORTAL_SYNC_REASON_CODES.AUTH_TOKEN_PERMISSION_FAILURE;
+    if (status === 400)
+        return RUNNER_PORTAL_SYNC_REASON_CODES.PORTAL_SYNC_PAYLOAD_REJECTED;
+    return RUNNER_PORTAL_SYNC_REASON_CODES.BACKOFF_SCHEDULED;
+}
+function classifyPortalSyncError(error) {
+    if (isRecord(error)) {
+        const code = typeof error.reasonCode === 'string' ? error.reasonCode : typeof error.code === 'string' ? error.code : undefined;
+        if (code && SAFE_REASON_CODE_PATTERN.test(code))
+            return code;
+    }
+    const message = error instanceof Error ? error.message : String(error);
+    if (/sqlite-adapter-unavailable/i.test(message))
+        return RUNNER_PORTAL_SYNC_REASON_CODES.SQLITE_ADAPTER_UNAVAILABLE;
+    if (/integrity|corrupt|malformed|not a database/i.test(message))
+        return RUNNER_PORTAL_SYNC_REASON_CODES.SQLITE_INTEGRITY_FAILED;
+    return RUNNER_PORTAL_SYNC_REASON_CODES.BACKOFF_SCHEDULED;
+}
+function withTimeout(promise, timeoutMs) {
+    return new Promise((resolvePromise, rejectPromise) => {
+        const timer = setTimeout(() => rejectPromise(new Error('portal-http-timeout')), timeoutMs);
+        if (typeof timer.unref === 'function')
+            timer.unref();
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolvePromise(value);
+        }, (error) => {
+            clearTimeout(timer);
+            rejectPromise(error);
+        });
+    });
+}
+function collectUnsafeValueRedactions(value, path, redactions) {
+    if (typeof value === 'string') {
+        if (UNSAFE_VALUE_PATTERN.test(value))
+            redactions.push(redaction(path, unsafeValueReason(value), 'value-denied'));
+        return;
+    }
+    if (value === null || typeof value === 'number' || typeof value === 'boolean' || value === undefined)
+        return;
+    if (Array.isArray(value)) {
+        for (const [index, child] of value.entries())
+            collectUnsafeValueRedactions(child, `${path}.${index}`, redactions);
+        return;
+    }
+    if (isRecord(value)) {
+        for (const [key, child] of Object.entries(value)) {
+            const childPath = `${path}.${boundPublicText(key, 80)}`;
+            if (UNSAFE_KEY_PATTERN.test(key))
+                redactions.push(redaction(childPath, 'unsafe_key', 'key-denied'));
+            collectUnsafeValueRedactions(child, childPath, redactions);
+        }
+    }
+}
+function unsafeValueReason(value) {
+    if (/https?:\/\//i.test(value))
+        return 'private_url';
+    if (/(?:^|\s)(?:\/(?:home|Users|media|mnt|tmp|var|etc|private)\/\S+|[A-Za-z]:\\\S+)/i.test(value))
+        return 'local_absolute_path';
+    if (/secret|token|password|api[_-]?key|license[_-]?key|authorization/i.test(value))
+        return 'secret';
+    if (/stdout|stderr|raw[_-]?log|transcript|stack/i.test(value))
+        return 'raw_log';
+    if (/prompt|workflow body|step body/i.test(value))
+        return 'prompt_body';
+    return 'protected_field';
+}
+function redaction(field, reason, evidence = 'value-denied') {
+    return { field: boundPublicText(field, 120), reason, evidence, publicSafe: true };
+}
+function uniqueRedactions(values) {
+    const seen = new Set();
+    const output = [];
+    for (const value of values) {
+        const key = `${value.field}:${value.reason}:${value.evidence}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        output.push(value);
+    }
+    return output.slice(0, 20);
+}
+function sanitizeRunnerId(value) {
+    const sanitized = sanitizeId(value);
+    return SAFE_RUNNER_ID_PATTERN.test(sanitized) ? sanitized : `runner-${sha256Hex(value).slice(0, 16)}`;
+}
+function sanitizeId(value) {
+    if (UNSAFE_VALUE_PATTERN.test(value))
+        return `id-${sha256Hex(value).slice(0, 16)}`;
+    const safe = value.replace(/[^A-Za-z0-9._:-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 120);
+    return safe.length > 0 ? safe : `id-${sha256Hex(value).slice(0, 16)}`;
+}
+function sanitizePublicLabel(value, fallback) {
+    const normalized = (value ?? '').replace(/\s+/g, ' ').trim();
+    if (!normalized)
+        return fallback;
+    if (UNSAFE_VALUE_PATTERN.test(normalized) || UNSAFE_LABEL_PATTERN.test(normalized))
+        return fallback;
+    const safe = normalized.replace(/[^A-Za-z0-9 ._-]+/g, ' ').replace(/\s+/g, ' ').trim();
+    if (!safe)
+        return fallback;
+    return safe.length <= 80 ? safe : `${safe.slice(0, 77)}...`;
+}
+function isSafePublicId(value) {
+    return SAFE_ID_PATTERN.test(value) && !UNSAFE_VALUE_PATTERN.test(value);
+}
+function isSafePublicLabel(value) {
+    return value.trim().length > 0
+        && value.length <= 80
+        && !UNSAFE_VALUE_PATTERN.test(value)
+        && !UNSAFE_LABEL_PATTERN.test(value);
+}
+function isSafePublicJobId(value) {
+    return SAFE_JOB_ID_PATTERN.test(value) && !UNSAFE_VALUE_PATTERN.test(value);
+}
+function safeReasonCode(value) {
+    return SAFE_REASON_CODE_PATTERN.test(value) && !UNSAFE_VALUE_PATTERN.test(value) ? value : RUNNER_PORTAL_SYNC_REASON_CODES.OK;
+}
+function safeJobKind(value) {
+    return ['goal', 'loop', 'runner', 'jobs'].includes(value) ? value : 'jobs';
+}
+function safeJobStatus(value) {
+    return ['draft', 'planned', 'active', 'running', 'waiting_external', 'waiting_human', 'backoff', 'paused', 'blocked', 'completed', 'aborted', 'cancelled'].includes(value) ? value : 'active';
+}
+function safeReceiptStatus(value) {
+    return ['accepted', 'applied', 'ignored', 'failed', 'deferred'].includes(value) ? value : 'accepted';
+}
+function filterFiniteCounts(input) {
+    const output = {};
+    for (const [key, value] of Object.entries(input)) {
+        if (/^[A-Za-z][A-Za-z0-9_:-]{0,63}$/.test(key) && Number.isFinite(value) && value >= 0)
+            output[key] = Math.trunc(value);
+    }
+    return output;
+}
+function minIso(values) {
+    return values.filter((value) => Number.isFinite(Date.parse(value))).sort()[0];
+}
+function boundedInteger(value, min, max) {
+    if (!Number.isFinite(value))
+        return min;
+    return Math.max(min, Math.min(max, Math.floor(value)));
+}
+function boundedNumber(value, min, max) {
+    if (!Number.isFinite(value))
+        return min;
+    return Math.max(min, Math.min(max, value));
+}
+function jitteredDelayMs(baseDelayMs, jitterRatio, random) {
+    if (baseDelayMs <= 0)
+        return 0;
+    if (jitterRatio <= 0)
+        return baseDelayMs;
+    const boundedRandom = boundedNumber(random(), 0, 1);
+    const jitter = Math.floor(baseDelayMs * jitterRatio * boundedRandom);
+    return Math.max(0, baseDelayMs + jitter);
+}
+function sha256Hex(value) {
+    return createHash('sha256').update(value).digest('hex');
+}
+function boundPublicText(value, maxChars) {
+    const redacted = UNSAFE_VALUE_PATTERN.test(value) ? '[REDACTED]' : value;
+    return redacted.length <= maxChars ? redacted : `${redacted.slice(0, maxChars)}...[TRUNCATED:${redacted.length - maxChars}]`;
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function unique(values) {
+    return Array.from(new Set(values));
+}
+function sleep(ms) {
+    return new Promise((resolvePromise) => setTimeout(resolvePromise, ms));
+}