@taskforcehq/taskforce 0.3.324 → 0.3.327

package/dist/sync/v3/taskCommentMutationService.js

@@ -0,0 +1,392 @@
+import { serializeTaskForSync } from '../taskSyncPayload.js';
+import { canonicalWorkspaceSyncJson } from './canonicalWorkspaceSyncJson.js';
+import { buildTaskCommentActivityEventId } from './taskCommentActivityIdentity.js';
+import { asWorkspaceSyncActivityRevision, buildTaskActivityJournalEntry, serializeTaskActivityForSync, } from './taskActivityJournal.js';
+import { fingerprintWorkspaceSyncPayload, WORKSPACE_SYNC_CONTRACT_VERSION, } from './syncDurabilityStore.js';
+import { mergeWorkspaceSyncV3TaskCommentsPayload, serializeWorkspaceSyncV3TaskCommentAppendPayload, serializeWorkspaceSyncV3TaskCommentsPayload, taskCommentBodiesMatchIgnoringProvenance, } from './workspaceSyncV3NestedTaskCodecs.js';
+import { resolveDeferredMutationActorRef } from './workspaceSyncV3OriginActor.js';
+import { UNVERIFIED_COMMENT_IMPORT_ACTOR } from '../../shared/commentProvenance.js';
+import { validateWorkspaceSyncV3TaskCommentReconcileProvenance, } from './taskCommentReconcileProvenance.js';
+export { UNVERIFIED_COMMENT_IMPORT_ACTOR };
+export class DurableTaskCommentMutationError extends Error {
+    code;
+    statusCode;
+    details;
+    retryable;
+    retryAfterAt;
+    retryHint;
+    constructor(message, code, statusCode, details, retryable, retryAfterAt, retryHint) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.details = details;
+        this.retryable = retryable;
+        this.retryAfterAt = retryAfterAt;
+        this.retryHint = retryHint;
+        this.name = 'DurableTaskCommentMutationError';
+    }
+}
+function canonicalComment(input) {
+    const payload = serializeWorkspaceSyncV3TaskCommentsPayload({
+        taskId: '__validation__', comments: [{ ...input, submittedAuthor: input.submittedAuthor || input.author }],
+    });
+    if (payload.comments.length !== 1) {
+        throw new DurableTaskCommentMutationError('Task comment is invalid.', 'TASK_COMMENT_INVALID', 400);
+    }
+    return payload.comments[0];
+}
+function nextUpdatedAt(current, requested) {
+    const currentMs = Date.parse(current);
+    const requestedMs = Date.parse(requested);
+    if (!Number.isFinite(requestedMs) || new Date(requestedMs).toISOString() !== requested) {
+        throw new DurableTaskCommentMutationError('Task comment timestamp is invalid.', 'TASK_COMMENT_INVALID', 400);
+    }
+    return Number.isFinite(currentMs) && currentMs >= requestedMs
+        ? new Date(currentMs + 1).toISOString()
+        : requested;
+}
+function revision(revisions, domain) {
+    const found = revisions.find((entry) => entry.domain === domain);
+    if (!found)
+        throw new Error(`Durable task comment ${domain} revision is missing.`);
+    return found;
+}
+export function runDurableTaskCommentAppend(input) {
+    const identity = {
+        tenantId: input.tenantId,
+        workspaceId: input.workspaceId,
+        clientId: input.clientId,
+        operationId: input.operationId,
+    };
+    const committed = input.store.readOperationStateForUpdate(identity);
+    let committedResponse = null;
+    if (committed?.status === 'committed') {
+        if (!committed.responseJson)
+            throw new Error('Committed task comment operation is missing its response.');
+        committedResponse = JSON.parse(committed.responseJson);
+        if (committedResponse.authoritative.comments.entityId !== input.taskId) {
+            throw new DurableTaskCommentMutationError('Task comment operation identity conflicts with a committed operation.', 'TASK_COMMENT_IDENTITY_CONFLICT', 409);
+        }
+    }
+    const committedComment = committedResponse?.authoritative.comments.payload.comments
+        .find((entry) => entry.id === input.comment.id);
+    if (committedResponse && !committedComment) {
+        throw new DurableTaskCommentMutationError('Task comment operation identity conflicts with a committed operation.', 'TASK_COMMENT_IDENTITY_CONFLICT', 409);
+    }
+    const contentActorRef = committedComment?.author || resolveDeferredMutationActorRef(input);
+    const comment = canonicalComment({
+        ...input.comment,
+        author: contentActorRef,
+        submittedAuthor: contentActorRef,
+    });
+    const requestFingerprint = fingerprintWorkspaceSyncPayload({
+        contractVersion: WORKSPACE_SYNC_CONTRACT_VERSION,
+        identity,
+        operation: {
+            domain: 'task-comments', entityId: input.taskId, mutationKind: 'append',
+            baseEntityRevision: String(input.baseEntityRevision),
+            baseLifecycleRevision: String(input.baseLifecycleRevision),
+            comment: {
+                id: comment.id,
+                author: comment.author,
+                submittedAuthor: comment.submittedAuthor,
+                text: comment.text,
+            },
+            ...(input.originActorRef ? { originActorRef: input.originActorRef } : {}),
+        },
+    });
+    const activityEventId = buildTaskCommentActivityEventId({
+        workspaceId: input.workspaceId,
+        clientId: input.clientId,
+        operationId: input.operationId,
+        taskId: input.taskId,
+        commentId: comment.id,
+    });
+    const reservation = input.store.reserveOperation({
+        identity, requestFingerprint, now: input.now, leaseExpiresAt: input.leaseExpiresAt, leaseOwner: input.leaseOwner,
+    });
+    if (reservation.state === 'in_progress')
+        return reservation;
+    if (reservation.state === 'committed') {
+        return {
+            state: 'committed', replayed: true, responseJson: reservation.responseJson,
+            response: JSON.parse(reservation.responseJson),
+        };
+    }
+    const readActivity = () => {
+        const activity = input.core.getTaskEventForSync({
+            workspaceId: input.workspaceId, taskId: input.taskId, eventId: activityEventId,
+        });
+        if (!activity)
+            throw new Error('Durable task comment activity was not persisted.');
+        return activity;
+    };
+    const accepted = input.store.acceptReservedOperationBatch({
+        identity,
+        requestFingerprint,
+        leaseOwner: reservation.leaseOwner,
+        now: input.now,
+        entries: [{
+                domain: 'task', entityId: input.taskId, mutationKind: 'metadata-update', revisionKind: 'metadata',
+                baseEntityRevision: '0', baseLifecycleRevision: '0', baseRevisionPolicy: 'current',
+                buildCanonicalFingerprint: (task) => fingerprintWorkspaceSyncPayload(serializeTaskForSync(task)),
+                buildAuthoritativePayload: (task) => serializeTaskForSync(task),
+            }, {
+                domain: 'task-comments', entityId: input.taskId, mutationKind: 'append', revisionKind: 'metadata',
+                baseEntityRevision: input.baseEntityRevision, baseLifecycleRevision: input.baseLifecycleRevision,
+                baseRevisionPolicy: 'current',
+                buildCanonicalFingerprint: (task) => fingerprintWorkspaceSyncPayload(serializeWorkspaceSyncV3TaskCommentsPayload({ taskId: task.id, comments: task.comments || [] })),
+                buildAuthoritativePayload: (task) => serializeWorkspaceSyncV3TaskCommentAppendPayload({
+                    taskId: task.id, comment, commentsAfterAppend: task.comments || [],
+                }),
+            }, buildTaskActivityJournalEntry({ eventId: activityEventId, readEvent: readActivity })],
+        applyMutation: () => {
+            const existing = input.core.getTask(input.taskId, input.workspaceId);
+            if (!existing)
+                throw new DurableTaskCommentMutationError('Task not found.', 'TASK_NOT_FOUND', 404);
+            if (existing.isArchived) {
+                throw new DurableTaskCommentMutationError('Archived tasks are read-only. Unarchive first to make changes.', 'TASK_ARCHIVED_READ_ONLY', 409);
+            }
+            const comments = serializeWorkspaceSyncV3TaskCommentsPayload({
+                taskId: existing.id, comments: existing.comments || [],
+            }).comments;
+            const collision = comments.find((entry) => entry.id === comment.id);
+            if (collision) {
+                const qualifier = canonicalWorkspaceSyncJson(collision) === canonicalWorkspaceSyncJson(comment)
+                    ? 'is already owned by another operation'
+                    : 'has different content';
+                throw new DurableTaskCommentMutationError(`Task comment identity conflict: ${comment.id} ${qualifier}.`, 'TASK_COMMENT_IDENTITY_CONFLICT', 409);
+            }
+            const updatedAt = nextUpdatedAt(String(existing.updatedAt || existing.createdAt), input.now);
+            const task = input.core.updateTask(existing.id, { comments: [...comments, comment] }, input.workspaceId, {
+                persistBackup: false,
+                emitRealtime: false,
+                skipTaskEvents: true,
+                syncUpdatedAt: updatedAt,
+                allowV3OwnedMetadataWrite: true,
+            });
+            if (!task)
+                throw new DurableTaskCommentMutationError('Task not found.', 'TASK_NOT_FOUND', 404);
+            input.core.addTaskCommentEventForDurableSync({
+                taskId: task.id, workspaceId: input.workspaceId, actor: contentActorRef,
+                eventId: activityEventId, createdAt: String(task.updatedAt || updatedAt), comment,
+            });
+            return task;
+        },
+        buildResponse: (task, revisions) => {
+            const rootRevision = revision(revisions, 'task');
+            const commentsRevision = revision(revisions, 'task-comments');
+            const activityRevision = asWorkspaceSyncActivityRevision(revision(revisions, 'entity-event'));
+            return {
+                success: true,
+                contractVersion: WORKSPACE_SYNC_CONTRACT_VERSION,
+                workspaceId: input.workspaceId,
+                clientId: input.clientId,
+                operationId: input.operationId,
+                acceptedSequence: rootRevision.sequence,
+                operationHighWatermark: activityRevision.sequence,
+                authoritative: {
+                    root: {
+                        domain: 'task', entityId: task.id, mutationKind: 'metadata-update',
+                        sequence: rootRevision.sequence, entityRevision: rootRevision.entityRevision,
+                        lifecycleRevision: rootRevision.lifecycleRevision, payload: serializeTaskForSync(task),
+                    },
+                    comments: {
+                        domain: 'task-comments', entityId: task.id, mutationKind: 'append',
+                        sequence: commentsRevision.sequence, entityRevision: commentsRevision.entityRevision,
+                        lifecycleRevision: commentsRevision.lifecycleRevision,
+                        payload: serializeWorkspaceSyncV3TaskCommentsPayload({ taskId: task.id, comments: task.comments || [] }),
+                    },
+                },
+                activity: serializeTaskActivityForSync(readActivity()),
+                activityRevision,
+            };
+        },
+    });
+    try {
+        input.core.notifyDurableTaskMetadataCommitted(input.workspaceId, input.taskId);
+    }
+    catch (error) {
+        try {
+            input.onPostCommitError?.(error);
+        }
+        catch { /* durable mutation remains committed */ }
+    }
+    return {
+        state: 'committed', replayed: false, responseJson: accepted.responseJson,
+        response: JSON.parse(accepted.responseJson),
+    };
+}
+export function runDurableTaskCommentReconcile(input) {
+    const verifiedContentActorIds = new Set();
+    const requested = serializeWorkspaceSyncV3TaskCommentsPayload({
+        taskId: input.taskId,
+        comments: input.comments,
+    });
+    const provenance = validateWorkspaceSyncV3TaskCommentReconcileProvenance(input.provenance || []);
+    const identity = {
+        tenantId: input.tenantId,
+        workspaceId: input.workspaceId,
+        clientId: input.clientId,
+        operationId: input.operationId,
+    };
+    const requestFingerprint = fingerprintWorkspaceSyncPayload({
+        contractVersion: WORKSPACE_SYNC_CONTRACT_VERSION,
+        identity,
+        operation: {
+            domain: 'task-comments',
+            entityId: input.taskId,
+            mutationKind: 'reconcile',
+            baseEntityRevision: String(input.baseEntityRevision),
+            baseLifecycleRevision: String(input.baseLifecycleRevision),
+            comments: requested.comments,
+            provenance,
+        },
+    });
+    const reservation = input.store.reserveOperation({
+        identity,
+        requestFingerprint,
+        now: input.now,
+        leaseExpiresAt: input.leaseExpiresAt,
+        leaseOwner: input.leaseOwner,
+    });
+    if (reservation.state === 'in_progress')
+        return reservation;
+    if (reservation.state === 'committed') {
+        return {
+            state: 'committed',
+            replayed: true,
+            responseJson: reservation.responseJson,
+            response: JSON.parse(reservation.responseJson),
+        };
+    }
+    const accepted = input.store.acceptReservedOperationBatch({
+        identity,
+        requestFingerprint,
+        leaseOwner: reservation.leaseOwner,
+        now: input.now,
+        // Reconciliation owns only the comment aggregate. Keeping the batch
+        // comments-only prevents an unacknowledged task-root revision advance.
+        entries: [{
+                domain: 'task-comments',
+                entityId: input.taskId,
+                mutationKind: 'replace',
+                revisionKind: 'metadata',
+                // Reconciliation is an append-only stable-ID union used specifically
+                // when the client and authority disagree. The request revision remains
+                // part of the idempotency fingerprint, but must not prevent the repair
+                // from merging under the authoritative workspace lock.
+                baseEntityRevision: 0,
+                baseLifecycleRevision: 0,
+                baseRevisionPolicy: 'current',
+                buildCanonicalFingerprint: (task) => fingerprintWorkspaceSyncPayload(serializeWorkspaceSyncV3TaskCommentsPayload({
+                    taskId: task.id,
+                    comments: task.comments || [],
+                })),
+                buildAuthoritativePayload: (task) => serializeWorkspaceSyncV3TaskCommentsPayload({
+                    taskId: task.id,
+                    comments: task.comments || [],
+                }),
+            }],
+        applyMutation: () => {
+            const existing = input.core.getTask(input.taskId, input.workspaceId);
+            if (!existing) {
+                throw new DurableTaskCommentMutationError('Task not found.', 'TASK_NOT_FOUND', 404);
+            }
+            const authoritativeById = new Map((existing.comments || []).map((comment) => [comment.id, comment]));
+            const provenanceByCommentId = new Map(provenance.map((entry) => [entry.commentId, entry]));
+            const importSafeRequested = requested.comments.map((comment) => {
+                const authoritative = authoritativeById.get(comment.id);
+                if (authoritative) {
+                    if (canonicalWorkspaceSyncJson(authoritative)
+                        !== canonicalWorkspaceSyncJson(comment)
+                        && !taskCommentBodiesMatchIgnoringProvenance(authoritative, comment)) {
+                        throw new DurableTaskCommentMutationError('Task comment identity conflict: reconciliation cannot change an authoritative comment.', 'TASK_COMMENT_IDENTITY_CONFLICT', 409);
+                    }
+                    verifiedContentActorIds.add(String(authoritative.author || '').trim());
+                    return authoritative;
+                }
+                const claim = provenanceByCommentId.get(comment.id);
+                if (!claim || !input.resolveTaskCommentReconcileActor) {
+                    throw new DurableTaskCommentMutationError(`Task comment reconciliation provenance is missing or unverifiable: ${comment.id}.`, 'TASK_COMMENT_INVALID', 400);
+                }
+                const verifiedActor = String(input.resolveTaskCommentReconcileActor(comment, claim) || '').trim();
+                if (!verifiedActor) {
+                    throw new DurableTaskCommentMutationError(`Task comment reconciliation provenance is unverifiable: ${comment.id}.`, 'TASK_COMMENT_INVALID', 400);
+                }
+                verifiedContentActorIds.add(verifiedActor);
+                return {
+                    ...comment,
+                    author: verifiedActor,
+                    submittedAuthor: verifiedActor,
+                };
+            });
+            let merged;
+            try {
+                merged = mergeWorkspaceSyncV3TaskCommentsPayload({
+                    taskId: existing.id,
+                    left: existing.comments || [],
+                    right: importSafeRequested,
+                });
+            }
+            catch (error) {
+                throw new DurableTaskCommentMutationError(String(error?.message || 'Task comment identity conflict.'), 'TASK_COMMENT_IDENTITY_CONFLICT', 409);
+            }
+            const task = input.core.updateTask(existing.id, { comments: merged.comments }, input.workspaceId, {
+                persistBackup: false,
+                emitRealtime: false,
+                skipTaskEvents: true,
+                syncUpdatedAt: String(existing.updatedAt || existing.createdAt),
+                allowV3OwnedMetadataWrite: true,
+                allowArchivedNestedContentSyncWrite: true,
+            });
+            if (!task) {
+                throw new DurableTaskCommentMutationError('Task not found.', 'TASK_NOT_FOUND', 404);
+            }
+            return task;
+        },
+        buildResponse: (task, revisions) => {
+            const commentsRevision = revision(revisions, 'task-comments');
+            return {
+                success: true,
+                contractVersion: WORKSPACE_SYNC_CONTRACT_VERSION,
+                workspaceId: input.workspaceId,
+                clientId: input.clientId,
+                operationId: input.operationId,
+                acceptedSequence: commentsRevision.sequence,
+                operationHighWatermark: commentsRevision.sequence,
+                verifiedContentActorIds: [...verifiedContentActorIds].filter(Boolean).sort(),
+                authoritative: {
+                    comments: {
+                        domain: 'task-comments',
+                        entityId: task.id,
+                        mutationKind: 'reconcile',
+                        sequence: commentsRevision.sequence,
+                        entityRevision: commentsRevision.entityRevision,
+                        lifecycleRevision: commentsRevision.lifecycleRevision,
+                        payload: serializeWorkspaceSyncV3TaskCommentsPayload({
+                            taskId: task.id,
+                            comments: task.comments || [],
+                        }),
+                    },
+                },
+            };
+        },
+    });
+    const response = JSON.parse(accepted.responseJson);
+    try {
+        input.core.notifyDurableTaskMetadataCommitted(input.workspaceId, input.taskId);
+    }
+    catch (error) {
+        try {
+            input.onPostCommitError?.(error);
+        }
+        catch { /* mutation and committed response remain durable */ }
+    }
+    return {
+        state: 'committed',
+        replayed: false,
+        responseJson: accepted.responseJson,
+        response,
+    };
+}

package/dist/sync/v3/taskCommentReconcileProvenance.d.ts

@@ -0,0 +1,58 @@
+import type { Comment, TaskEvent } from '../../core/Taskforce.js';
+export type WorkspaceSyncV3TaskCommentReconcileProvenance = {
+    commentId: string;
+    actor: {
+        kind: 'authorization-actor';
+        actorRef: string;
+    };
+} | {
+    commentId: string;
+    actor: {
+        kind: 'ai-profile';
+        profileId: string;
+        assertion: string;
+    };
+} | {
+    commentId: string;
+    actor: {
+        kind: 'authoritative-entity-event';
+        eventId: string;
+    };
+};
+export declare function signWorkspaceSyncV3TaskCommentReconcileProvenance(input: {
+    workspaceId: string;
+    clientId: string;
+    operationId: string;
+    taskId: string;
+    comment: Comment;
+    profileId: string;
+    profileToken: string;
+}): WorkspaceSyncV3TaskCommentReconcileProvenance;
+export declare function buildWorkspaceSyncV3TaskCommentReconcileProvenance(input: {
+    workspaceId: string;
+    clientId: string;
+    operationId: string;
+    taskId: string;
+    comments: readonly Comment[];
+    evidenceByCommentId: ReadonlyMap<string, WorkspaceSyncV3TaskCommentProvenanceEvidence>;
+    aiProfiles: readonly {
+        id: string;
+        profileToken?: string | null;
+    }[];
+}): WorkspaceSyncV3TaskCommentReconcileProvenance[];
+export type WorkspaceSyncV3TaskCommentProvenanceEvidence = {
+    actorRef: string;
+    submittedAuthor: string;
+    preview: string;
+};
+export declare function indexWorkspaceSyncV3TaskCommentProvenanceEvidence(activities: readonly TaskEvent[]): Map<string, WorkspaceSyncV3TaskCommentProvenanceEvidence>;
+export declare function verifyWorkspaceSyncV3TaskCommentReconcileProvenance(input: {
+    workspaceId: string;
+    clientId: string;
+    operationId: string;
+    taskId: string;
+    comment: Comment;
+    provenance: WorkspaceSyncV3TaskCommentReconcileProvenance;
+    profileToken: string;
+}): boolean;
+export declare function validateWorkspaceSyncV3TaskCommentReconcileProvenance(value: unknown): WorkspaceSyncV3TaskCommentReconcileProvenance[];

package/dist/sync/v3/taskCommentReconcileProvenance.js

@@ -0,0 +1,170 @@
+import { createHmac, timingSafeEqual } from 'crypto';
+import { canonicalWorkspaceSyncJson } from './canonicalWorkspaceSyncJson.js';
+function requiredText(value, label) {
+    const normalized = String(value || '').trim();
+    if (!normalized)
+        throw new Error(`${label} is required.`);
+    return normalized;
+}
+function assertionBinding(input) {
+    return canonicalWorkspaceSyncJson({
+        contractVersion: 3,
+        purpose: 'task-comment-reconcile-provenance-v1',
+        workspaceId: requiredText(input.workspaceId, 'workspaceId'),
+        clientId: requiredText(input.clientId, 'clientId'),
+        operationId: requiredText(input.operationId, 'operationId'),
+        taskId: requiredText(input.taskId, 'taskId'),
+        profileId: requiredText(input.profileId, 'profileId'),
+        comment: input.comment,
+    });
+}
+export function signWorkspaceSyncV3TaskCommentReconcileProvenance(input) {
+    const profileToken = requiredText(input.profileToken, 'profileToken');
+    const assertion = createHmac('sha256', profileToken)
+        .update(assertionBinding(input))
+        .digest('hex');
+    return {
+        commentId: requiredText(input.comment.id, 'comment.id'),
+        actor: {
+            kind: 'ai-profile',
+            profileId: requiredText(input.profileId, 'profileId'),
+            assertion,
+        },
+    };
+}
+export function buildWorkspaceSyncV3TaskCommentReconcileProvenance(input) {
+    const profiles = new Map(input.aiProfiles.map((profile) => [profile.id, profile]));
+    return input.comments.flatMap((comment) => {
+        const evidence = input.evidenceByCommentId.get(comment.id);
+        const actorRef = String(evidence?.actorRef || '').trim();
+        if (!actorRef
+            || evidence?.submittedAuthor !== String(comment.submittedAuthor || comment.author || '').trim()
+            || evidence?.preview !== comment.text.slice(0, 160))
+            return [];
+        if (!actorRef.startsWith('ai-profile-')) {
+            return [{
+                    commentId: comment.id,
+                    actor: { kind: 'authorization-actor', actorRef },
+                }];
+        }
+        const profile = profiles.get(actorRef);
+        const profileToken = String(profile?.profileToken || '').trim();
+        if (!profile || !profileToken)
+            return [];
+        return [signWorkspaceSyncV3TaskCommentReconcileProvenance({
+                workspaceId: input.workspaceId,
+                clientId: input.clientId,
+                operationId: input.operationId,
+                taskId: input.taskId,
+                comment,
+                profileId: profile.id,
+                profileToken,
+            })];
+    });
+}
+export function indexWorkspaceSyncV3TaskCommentProvenanceEvidence(activities) {
+    const grouped = new Map();
+    for (const activity of activities) {
+        if (activity.action !== 'task-comment-added')
+            continue;
+        const commentId = String(activity.details?.commentId || '').trim();
+        if (!commentId)
+            continue;
+        grouped.set(commentId, [...(grouped.get(commentId) || []), activity]);
+    }
+    const result = new Map();
+    for (const [commentId, matches] of grouped) {
+        if (matches.length !== 1)
+            continue;
+        const activity = matches[0];
+        const actorRef = String(activity.actor || '').trim();
+        const submittedAuthor = String(activity.details?.submittedAuthor || '').trim();
+        const preview = String(activity.details?.preview || '');
+        if (!actorRef || !submittedAuthor)
+            continue;
+        result.set(commentId, { actorRef, submittedAuthor, preview });
+    }
+    return result;
+}
+export function verifyWorkspaceSyncV3TaskCommentReconcileProvenance(input) {
+    if (input.provenance.actor.kind !== 'ai-profile')
+        return false;
+    const expected = signWorkspaceSyncV3TaskCommentReconcileProvenance({
+        ...input,
+        profileId: input.provenance.actor.profileId,
+        profileToken: input.profileToken,
+    });
+    if (expected.actor.kind !== 'ai-profile')
+        return false;
+    const actualBytes = Buffer.from(input.provenance.actor.assertion, 'utf8');
+    const expectedBytes = Buffer.from(expected.actor.assertion, 'utf8');
+    return actualBytes.length === expectedBytes.length
+        && timingSafeEqual(actualBytes, expectedBytes);
+}
+export function validateWorkspaceSyncV3TaskCommentReconcileProvenance(value) {
+    if (!Array.isArray(value))
+        throw new Error('Task comment reconciliation provenance must be an array.');
+    const seen = new Set();
+    const claims = value.map((candidate) => {
+        if (!candidate || typeof candidate !== 'object' || Array.isArray(candidate)) {
+            throw new Error('Task comment reconciliation provenance entry must be an object.');
+        }
+        const source = candidate;
+        if (Object.keys(source).sort().join(',') !== 'actor,commentId') {
+            throw new Error('Task comment reconciliation provenance entry must contain exactly actor and commentId.');
+        }
+        const commentId = requiredText(source.commentId, 'Task comment reconciliation provenance commentId');
+        if (seen.has(commentId)) {
+            throw new Error(`Task comment reconciliation provenance contains duplicate comment id ${commentId}.`);
+        }
+        seen.add(commentId);
+        if (!source.actor || typeof source.actor !== 'object' || Array.isArray(source.actor)) {
+            throw new Error('Task comment reconciliation provenance actor must be an object.');
+        }
+        const actor = source.actor;
+        if (actor.kind === 'authorization-actor') {
+            if (Object.keys(actor).sort().join(',') !== 'actorRef,kind') {
+                throw new Error('Authorization provenance must contain exactly actorRef and kind.');
+            }
+            return {
+                commentId,
+                actor: {
+                    kind: 'authorization-actor',
+                    actorRef: requiredText(actor.actorRef, 'Authorization provenance actorRef'),
+                },
+            };
+        }
+        if (actor.kind === 'ai-profile') {
+            if (Object.keys(actor).sort().join(',') !== 'assertion,kind,profileId') {
+                throw new Error('AI provenance must contain exactly assertion, kind, and profileId.');
+            }
+            const assertion = String(actor.assertion || '').trim();
+            if (!/^[a-f0-9]{64}$/.test(assertion)) {
+                throw new Error('AI provenance assertion is invalid.');
+            }
+            const profileId = requiredText(actor.profileId, 'AI provenance profileId');
+            if (!profileId.startsWith('ai-profile-')) {
+                throw new Error('AI provenance profileId must be an ai-profile id.');
+            }
+            return {
+                commentId,
+                actor: { kind: 'ai-profile', profileId, assertion },
+            };
+        }
+        if (actor.kind === 'authoritative-entity-event') {
+            if (Object.keys(actor).sort().join(',') !== 'eventId,kind') {
+                throw new Error('Authoritative entity-event provenance must contain exactly eventId and kind.');
+            }
+            const eventId = requiredText(actor.eventId, 'Authoritative entity-event provenance eventId');
+            if (!/^entity-event-sync-v3-[a-f0-9]{64}$/.test(eventId)) {
+                throw new Error('Authoritative entity-event provenance eventId is invalid.');
+            }
+            return {
+                commentId,
+                actor: { kind: 'authoritative-entity-event', eventId },
+            };
+        }
+        throw new Error('Task comment reconciliation provenance actor kind is invalid.');
+    });
+    return claims.sort((left, right) => left.commentId.localeCompare(right.commentId));
+}

package/dist/sync/v3/taskCreateActivation.d.ts

@@ -0,0 +1,19 @@
+import type { TaskItem } from '../../core/Taskforce.js';
+export type TaskCreateActivationCapability = {
+    taskCreateActivation: boolean;
+};
+export type TaskCreateActivationInput = {
+    task: Partial<TaskItem>;
+    localTask: Partial<TaskItem>;
+};
+/**
+ * Selects the strict task-create fields only when every still-legacy domain is
+ * in its default empty state. Unknown fields deliberately make the form
+ * ineligible so new form capabilities cannot enter v3 accidentally.
+ */
+export declare function selectTaskCreateActivationInput(value: unknown): TaskCreateActivationInput | null;
+export declare function selectStrictSimpleTaskCreateInput(value: unknown): Partial<TaskItem> | null;
+export declare function resolveTaskCreateActivationCapability(input: {
+    runtimeMode: 'local' | 'cloud';
+    env?: NodeJS.ProcessEnv;
+}): TaskCreateActivationCapability;