@taskforcehq/taskforce 0.3.326 → 0.3.328

package/dist/server/routes/syncV3OperationRoutes.js

@@ -0,0 +1,1151 @@
+import { EntityEventIdentityCollisionError } from '../../core/TaskActivityService.js';
+import { DurableTaskCreateMutationError } from '../../core/TaskDurableCreateMutationService.js';
+import { DurableTaskDeleteMutationError } from '../../core/TaskDurableDeleteMutationService.js';
+import { DurableTaskRestoreMutationError } from '../../core/TaskDurableRestoreMutationService.js';
+import { DurableTaskLifecycleMutationError } from '../../core/TaskDurableLifecycleMutationService.js';
+import { DurableTaskRelationshipMutationError } from '../../core/TaskDurableRelationshipMutationService.js';
+import { DurableTaskMetadataMutationError } from '../../core/TaskDurableSyncMutationService.js';
+import { DurableTaskWorkflowMutationError } from '../../core/TaskDurableWorkflowMutationService.js';
+import { WorkflowTaskActivationError } from '../../core/WorkflowTaskActivationService.js';
+import { parseTaskRestoreDestination } from '../../shared/taskRestoreDestination.js';
+import { DurableTaskStatusMutationError, validateDurableTaskStatusMutationPayload, } from '../../core/TaskDurableStatusMutationService.js';
+import { createWorkspaceSyncV3CloudOperationHandlers, dispatchWorkspaceSyncV3CloudOperation, } from '../../sync/v3/workspaceSyncV3CloudOperationHandler.js';
+import { DurableTaxonomyMutationError } from '../../sync/v3/taxonomySyncPayload.js';
+import { DurableInitiativeApplyError } from '../../core/InitiativeDurableMutationService.js';
+import { DurableWorkstreamApplyError } from '../../core/WorkstreamDurableMutationService.js';
+import { DurableInitiativeMutationError, validateDurableInitiativeComment, validateDurableInitiativeCreatePayload, validateDurableInitiativeMetadataPatch, validateEmptyInitiativePayload, } from '../../sync/v3/initiativeMutationPayload.js';
+import { DurableWorkstreamMutationError, validateDurableWorkstreamComment, validateDurableWorkstreamCreatePayload, validateDurableWorkstreamMetadataPatch, validateEmptyWorkstreamPayload, } from '../../sync/v3/workstreamMutationPayload.js';
+import { isWorkspaceSyncV3PlanningCloudEnabled } from '../../sync/v3/planningActivation.js';
+import { TaskLegacyRootAdoptionError } from '../../sync/v3/taskLegacyRootAdoptionService.js';
+import { TaskRelationshipLegacyAdoptionError } from '../../sync/v3/taskRelationshipLegacyAdoptionService.js';
+import { EntityEventLegacyAdoptionError, validateEntityEventLegacyAdoptionBatch, } from '../../sync/v3/entityEventLegacyAdoptionService.js';
+import { isLegacyEntityEventAdoptionIdentity, } from '../../sync/v3/entityEventLegacyAdoptionContract.js';
+import { validateCanonicalTaxonomyState } from '../../sync/v3/taxonomySyncPayload.js';
+import { validateTaxonomyTaskRemapPatches } from '../../sync/v3/taxonomyCompositeMutationService.js';
+import { WORKSPACE_SYNC_CONTRACT_VERSION, WorkspaceSyncDurabilityStore, WorkspaceSyncIdempotencyConflictError, WorkspaceSyncLeaseLostError, WorkspaceSyncRevisionConflictError, } from '../../sync/v3/syncDurabilityStore.js';
+import { parseWorkspaceSyncV3OriginActor, } from '../../sync/v3/workspaceSyncV3OriginActor.js';
+import { validateWorkspaceSyncV3TaskCommentReconcileProvenance, verifyWorkspaceSyncV3TaskCommentReconcileProvenance, } from '../../sync/v3/taskCommentReconcileProvenance.js';
+import { isStrongWorkspaceSyncV3OriginAssertionProfileToken, verifyWorkspaceSyncV3OriginAssertion, WORKSPACE_SYNC_V3_ORIGIN_ASSERTION_HEADER, workspaceSyncV3OriginAssertionBinding, } from '../../sync/v3/workspaceSyncV3OriginAssertion.js';
+import { validateWorkflowRuntimeMutationCommand } from '../../sync/v3/workflowRuntimeSync.js';
+import { resolveWorkflowRuntimeMutationCapability } from '../../sync/v3/durableWorkflowRuntimeMutationRouter.js';
+import { normalizeWorkflowAssignmentSyncRecord, WorkflowAssignmentSyncError, } from '../../sync/v3/workflowAssignmentSync.js';
+import { WorkflowAssignmentSyncConflictError } from '../../storage/workflowStore.js';
+import { DurableTaskCommentMutationError } from '../../sync/v3/taskCommentMutationService.js';
+import { DurableTaskChecklistMutationError } from '../../sync/v3/taskChecklistMutationService.js';
+import { DurableTaskAttachmentLinksMutationError } from '../../sync/v3/taskAttachmentLinksMutationService.js';
+import { validateWorkspaceSyncV3TaskAttachmentLinksPayload, validateWorkspaceSyncV3TaskChecklistPayload, validateWorkspaceSyncV3TaskCommentsPayload, } from '../../sync/v3/workspaceSyncV3NestedTaskCodecs.js';
+import { parseJsonBody } from './primitives.js';
+import { requireAuthenticatedSyncRequest, requireEnabledSyncAuth, resolveAuthorizedSyncWorkspace, } from './syncRouteGuards.js';
+const ROUTE_PATH = '/api/taskforce/sync/v3/workspace/operations';
+const OPERATION_LEASE_MS = 30_000;
+const MAX_BODY_BYTES = 1024 * 1024;
+const MAX_ID_LENGTH = 200;
+const CANONICAL_REVISION_PATTERN = /^(0|[1-9]\d*)$/;
+const RESERVED_REPAIR_CLIENT_ID = 'sync-v3-repair';
+const RESERVED_REPAIR_OPERATION_PREFIXES = ['repair-baseline-', 'initiative-baseline-'];
+class SyncV3RequestError extends Error {
+    code = 'WORKSPACE_SYNC_V3_REQUEST_INVALID';
+    statusCode = 400;
+}
+class SyncV3DependencyPendingError extends Error {
+    code = 'WORKSPACE_SYNC_V3_ORIGIN_PROFILE_PENDING';
+    statusCode = 425;
+}
+function committedResponseContentActor(responseJson) {
+    try {
+        const response = JSON.parse(responseJson);
+        for (const candidate of [
+            response.activity?.actor,
+            response.authoritativeActivity?.actor,
+            response.authoritative?.activity?.actor,
+            response.authoritative?.root?.payload?.createdBy,
+            response.authoritative?.payload?.createdBy,
+        ]) {
+            const actor = String(candidate || '').trim();
+            if (actor)
+                return actor;
+        }
+    }
+    catch {
+        // The durable handler owns response validation; audit must not trust the retry request.
+    }
+    return null;
+}
+function committedResponseContentActors(responseJson) {
+    try {
+        const response = JSON.parse(responseJson);
+        if (!Array.isArray(response.verifiedContentActorIds))
+            return [];
+        return [...new Set(response.verifiedContentActorIds
+                .map((actor) => String(actor || '').trim())
+                .filter(Boolean))].sort();
+    }
+    catch {
+        return [];
+    }
+}
+function writeJson(res, statusCode, payload) {
+    res.writeHead(statusCode, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(payload));
+}
+function assertExactKeys(value, expected, label) {
+    const expectedKeys = [...expected].sort();
+    const actualKeys = Object.keys(value).sort();
+    if (actualKeys.length !== expectedKeys.length || actualKeys.some((key, index) => key !== expectedKeys[index])) {
+        throw new SyncV3RequestError(`${label} contains missing or unknown fields.`);
+    }
+}
+function requireOriginActor(raw) {
+    try {
+        return parseWorkspaceSyncV3OriginActor(raw);
+    }
+    catch (error) {
+        throw new SyncV3RequestError(error instanceof Error ? error.message : 'operation.payload.originActor is invalid.');
+    }
+}
+function requireObject(value, label) {
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        throw new SyncV3RequestError(`${label} must be an object.`);
+    }
+    return value;
+}
+function requireId(value, label) {
+    if (typeof value !== 'string')
+        throw new SyncV3RequestError(`${label} must be a string.`);
+    const normalized = value.trim();
+    if (!normalized || normalized.length > MAX_ID_LENGTH) {
+        throw new SyncV3RequestError(`${label} must contain 1-${MAX_ID_LENGTH} characters.`);
+    }
+    return normalized;
+}
+function requireRevision(value, label) {
+    if (typeof value !== 'string' || !CANONICAL_REVISION_PATTERN.test(value)) {
+        throw new SyncV3RequestError(`${label} must be a canonical non-negative decimal string.`);
+    }
+    return value;
+}
+function requireRelationshipType(value) {
+    if (value === 'depends_on' || value === 'blocks' || value === 'related_to' || value === 'supersedes')
+        return value;
+    throw new SyncV3RequestError('operation.payload.type is not a supported task relationship type.');
+}
+export function parseWorkspaceSyncV3OperationEnvelope(body) {
+    const envelope = requireObject(body, 'Request');
+    assertExactKeys(envelope, ['contractVersion', 'workspaceId', 'clientId', 'operationId', 'operation'], 'Request');
+    if (envelope.contractVersion !== WORKSPACE_SYNC_CONTRACT_VERSION) {
+        throw new SyncV3RequestError(`contractVersion must be ${WORKSPACE_SYNC_CONTRACT_VERSION}.`);
+    }
+    const operation = requireObject(envelope.operation, 'operation');
+    assertExactKeys(operation, [
+        'domain', 'entityId', 'mutationKind', 'baseEntityRevision', 'baseLifecycleRevision', 'payload'
+    ], 'operation');
+    const clientId = requireId(envelope.clientId, 'clientId');
+    const operationId = requireId(envelope.operationId, 'operationId');
+    if (clientId === RESERVED_REPAIR_CLIENT_ID
+        || RESERVED_REPAIR_OPERATION_PREFIXES.some((prefix) => operationId.startsWith(prefix))) {
+        throw new SyncV3RequestError('Request identity is reserved for internal repair operations.');
+    }
+    const common = {
+        contractVersion: WORKSPACE_SYNC_CONTRACT_VERSION,
+        workspaceId: requireId(envelope.workspaceId, 'workspaceId'),
+        clientId,
+        operationId,
+    };
+    const entityId = requireId(operation.entityId, 'operation.entityId');
+    const baseEntityRevision = requireRevision(operation.baseEntityRevision, 'operation.baseEntityRevision');
+    const baseLifecycleRevision = requireRevision(operation.baseLifecycleRevision, 'operation.baseLifecycleRevision');
+    const payload = requireObject(operation.payload, 'operation.payload');
+    if (operation.domain === 'task' && operation.mutationKind === 'metadata-update') {
+        const saveSource = payload.saveSource;
+        assertExactKeys(payload, [
+            'patch',
+            ...(saveSource === undefined ? [] : ['saveSource']),
+            ...(payload.originActor === undefined ? [] : ['originActor']),
+        ], 'operation.payload');
+        if (saveSource !== undefined && saveSource !== 'manual' && saveSource !== 'autosave') {
+            throw new SyncV3RequestError('operation.payload.saveSource must be manual or autosave.');
+        }
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'metadata-update', baseEntityRevision, baseLifecycleRevision,
+                payload: {
+                    patch: requireObject(payload.patch, 'operation.payload.patch'),
+                    ...(saveSource ? { saveSource } : {}),
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'workflow-execution'
+        && (operation.mutationKind === 'transition' || operation.mutationKind === 'complete-step')) {
+        let command;
+        try {
+            command = validateWorkflowRuntimeMutationCommand(payload);
+        }
+        catch (error) {
+            throw new SyncV3RequestError(error instanceof Error ? error.message : 'Workflow runtime command is invalid.');
+        }
+        if (command.executionId !== entityId || command.kind !== operation.mutationKind) {
+            throw new SyncV3RequestError('Workflow runtime operation identity does not match its command.');
+        }
+        return { ...common, operation: {
+                domain: 'workflow-execution',
+                entityId,
+                mutationKind: command.kind,
+                baseEntityRevision,
+                baseLifecycleRevision,
+                payload: command,
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'create') {
+        if (baseEntityRevision !== '0' || baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Task create base revisions must both be 0.');
+        }
+        const hasTask = Object.prototype.hasOwnProperty.call(payload, 'task');
+        const hasAdoptedRoot = Object.prototype.hasOwnProperty.call(payload, 'adoptedRoot');
+        if (hasTask === hasAdoptedRoot) {
+            throw new SyncV3RequestError('Task create payload must contain exactly task or adoptedRoot.');
+        }
+        assertExactKeys(payload, hasTask
+            ? [
+                'task',
+                ...(payload.attachments !== undefined ? ['attachments'] : []),
+                ...(payload.comments !== undefined ? ['comments'] : []),
+                ...(payload.checklist !== undefined ? ['checklist'] : []),
+                ...(payload.originActor !== undefined ? ['originActor'] : []),
+            ]
+            : ['adoptedRoot'], 'operation.payload');
+        if (hasTask) {
+            let attachments;
+            if (payload.attachments !== undefined) {
+                try {
+                    attachments = validateWorkspaceSyncV3TaskAttachmentLinksPayload({
+                        taskId: entityId,
+                        links: payload.attachments,
+                    }).links;
+                }
+                catch (error) {
+                    throw new SyncV3RequestError(error instanceof Error ? error.message : 'Task create attachment links are invalid.');
+                }
+            }
+            let comments;
+            if (payload.comments !== undefined) {
+                try {
+                    comments = validateWorkspaceSyncV3TaskCommentsPayload({ taskId: entityId, comments: payload.comments }).comments;
+                }
+                catch (error) {
+                    throw new SyncV3RequestError(error instanceof Error ? error.message : 'Task create comments are invalid.');
+                }
+            }
+            let checklist;
+            if (payload.checklist !== undefined) {
+                try {
+                    checklist = validateWorkspaceSyncV3TaskChecklistPayload({ taskId: entityId, items: payload.checklist }).items;
+                }
+                catch (error) {
+                    throw new SyncV3RequestError(error instanceof Error ? error.message : 'Task create checklist is invalid.');
+                }
+            }
+            const originActor = payload.originActor === undefined
+                ? undefined
+                : requireOriginActor(payload.originActor);
+            return { ...common, operation: {
+                    domain: 'task', entityId, mutationKind: 'create', baseEntityRevision: '0', baseLifecycleRevision: '0',
+                    payload: {
+                        task: requireObject(payload.task, 'operation.payload.task'),
+                        ...(attachments ? { attachments } : {}),
+                        ...(comments ? { comments } : {}),
+                        ...(checklist ? { checklist } : {}),
+                        ...(originActor ? { originActor } : {}),
+                    },
+                } };
+        }
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'create', baseEntityRevision: '0', baseLifecycleRevision: '0',
+                payload: {
+                    adoptedRoot: requireObject(payload.adoptedRoot, 'operation.payload.adoptedRoot'),
+                },
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'delete') {
+        assertExactKeys(payload, ['relationships'], 'operation.payload');
+        if (!Array.isArray(payload.relationships) || payload.relationships.length > 99) {
+            throw new SyncV3RequestError('operation.payload.relationships must be an array with at most 99 entries.');
+        }
+        const relationships = payload.relationships.map((value, index) => {
+            const entry = requireObject(value, `operation.payload.relationships[${index}]`);
+            assertExactKeys(entry, ['entityId', 'baseEntityRevision', 'baseLifecycleRevision'], `operation.payload.relationships[${index}]`);
+            return {
+                entityId: requireId(entry.entityId, `operation.payload.relationships[${index}].entityId`),
+                baseEntityRevision: requireRevision(entry.baseEntityRevision, `operation.payload.relationships[${index}].baseEntityRevision`),
+                baseLifecycleRevision: requireRevision(entry.baseLifecycleRevision, `operation.payload.relationships[${index}].baseLifecycleRevision`),
+            };
+        });
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'delete', baseEntityRevision, baseLifecycleRevision,
+                payload: { relationships },
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'restore') {
+        assertExactKeys(payload, Object.prototype.hasOwnProperty.call(payload, 'restoreDestination')
+            ? ['restoreDestination']
+            : [], 'operation.payload');
+        const restoreDestination = parseTaskRestoreDestination(payload.restoreDestination);
+        if (!restoreDestination) {
+            throw new SyncV3RequestError('operation.payload.restoreDestination must be previous or archive.');
+        }
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'restore', baseEntityRevision, baseLifecycleRevision,
+                payload: { restoreDestination },
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'archive') {
+        assertExactKeys(payload, payload.originActor === undefined
+            ? ['cancellation', 'reason']
+            : ['cancellation', 'reason', 'originActor'], 'operation.payload');
+        if (typeof payload.cancellation !== 'boolean') {
+            throw new SyncV3RequestError('operation.payload.cancellation must be a boolean.');
+        }
+        if (payload.reason !== null && typeof payload.reason !== 'string') {
+            throw new SyncV3RequestError('operation.payload.reason must be a string or null.');
+        }
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'archive', baseEntityRevision, baseLifecycleRevision,
+                payload: {
+                    cancellation: payload.cancellation,
+                    reason: payload.reason,
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'unarchive') {
+        assertExactKeys(payload, payload.originActor === undefined ? [] : ['originActor'], 'operation.payload');
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'unarchive', baseEntityRevision, baseLifecycleRevision,
+                payload: { ...(originActor ? { originActor } : {}) },
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'complete') {
+        assertExactKeys(payload, payload.originActor === undefined ? [] : ['originActor'], 'operation.payload');
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'complete', baseEntityRevision, baseLifecycleRevision,
+                payload: { ...(originActor ? { originActor } : {}) },
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'reopen') {
+        assertExactKeys(payload, payload.originActor === undefined ? ['assignee'] : ['assignee', 'originActor'], 'operation.payload');
+        if (payload.assignee !== null && typeof payload.assignee !== 'string') {
+            throw new SyncV3RequestError('operation.payload.assignee must be a string or null.');
+        }
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'reopen', baseEntityRevision, baseLifecycleRevision,
+                payload: {
+                    assignee: payload.assignee,
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'task' && operation.mutationKind === 'set-status') {
+        const baseKeys = ['status', 'assigneeIntent', 'canceledReason', 'metadataPatch'];
+        assertExactKeys(payload, [
+            ...baseKeys,
+            ...(payload.workflowAssignment === undefined ? [] : ['workflowAssignment']),
+            ...(payload.originActor === undefined ? [] : ['originActor']),
+        ], 'operation.payload');
+        const normalizedPayload = validateDurableTaskStatusMutationPayload({
+            status: payload.status,
+            assigneeIntent: payload.assigneeIntent,
+            canceledReason: payload.canceledReason,
+            metadataPatch: payload.metadataPatch,
+        });
+        const workflowAssignment = payload.workflowAssignment === undefined
+            ? undefined
+            : normalizeWorkflowAssignmentSyncRecord(payload.workflowAssignment);
+        if (workflowAssignment
+            && (normalizedPayload.status !== 'in-progress'
+                || workflowAssignment.execution.taskId !== entityId)) {
+            throw new WorkflowAssignmentSyncError('Workflow assignment is only valid for the same task entering Working.');
+        }
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task', entityId, mutationKind: 'set-status', baseEntityRevision, baseLifecycleRevision,
+                payload: {
+                    ...normalizedPayload,
+                    ...(workflowAssignment ? { workflowAssignment } : {}),
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'task-comments' && operation.mutationKind === 'append') {
+        if (baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Task comment lifecycle revision must be 0.');
+        }
+        assertExactKeys(payload, payload.originActor === undefined ? ['comment'] : ['comment', 'originActor'], 'operation.payload');
+        let comments;
+        try {
+            comments = validateWorkspaceSyncV3TaskCommentsPayload({
+                taskId: entityId,
+                comments: [requireObject(payload.comment, 'operation.payload.comment')],
+            }).comments;
+        }
+        catch (error) {
+            throw new SyncV3RequestError(error instanceof Error ? error.message : 'operation.payload.comment is invalid.');
+        }
+        if (comments.length !== 1)
+            throw new SyncV3RequestError('operation.payload.comment is invalid.');
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task-comments', entityId, mutationKind: 'append', baseEntityRevision,
+                baseLifecycleRevision: '0',
+                payload: {
+                    comment: comments[0],
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'task-comments' && operation.mutationKind === 'reconcile') {
+        if (baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Task comment lifecycle revision must be 0.');
+        }
+        assertExactKeys(payload, ['comments', 'provenance'], 'operation.payload');
+        let comments;
+        let provenance;
+        try {
+            comments = validateWorkspaceSyncV3TaskCommentsPayload({
+                taskId: entityId,
+                comments: payload.comments,
+            }).comments;
+            provenance = validateWorkspaceSyncV3TaskCommentReconcileProvenance(payload.provenance);
+        }
+        catch (error) {
+            throw new SyncV3RequestError(error instanceof Error ? error.message : 'operation.payload.comments is invalid.');
+        }
+        return { ...common, operation: {
+                domain: 'task-comments',
+                entityId,
+                mutationKind: 'reconcile',
+                baseEntityRevision,
+                baseLifecycleRevision: '0',
+                payload: { comments, provenance },
+            } };
+    }
+    if (operation.domain === 'task-checklist' && operation.mutationKind === 'replace') {
+        if (baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Task checklist lifecycle revision must be 0.');
+        }
+        assertExactKeys(payload, payload.originActor === undefined ? ['items'] : ['items', 'originActor'], 'operation.payload');
+        let items;
+        try {
+            items = validateWorkspaceSyncV3TaskChecklistPayload({ taskId: entityId, items: payload.items }).items;
+        }
+        catch (error) {
+            throw new SyncV3RequestError(error instanceof Error ? error.message : 'operation.payload.items is invalid.');
+        }
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'task-checklist', entityId, mutationKind: 'replace', baseEntityRevision,
+                baseLifecycleRevision: '0',
+                payload: { items, ...(originActor ? { originActor } : {}) },
+            } };
+    }
+    if (operation.domain === 'task-attachment-links' && operation.mutationKind === 'replace') {
+        if (baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Task attachment-link lifecycle revision must be 0.');
+        }
+        assertExactKeys(payload, [
+            'links',
+            ...(payload.cardCoverAssetId === undefined ? [] : ['cardCoverAssetId']),
+            ...(payload.originActor === undefined ? [] : ['originActor']),
+        ], 'operation.payload');
+        let links;
+        try {
+            links = validateWorkspaceSyncV3TaskAttachmentLinksPayload({ taskId: entityId, links: payload.links }).links;
+        }
+        catch (error) {
+            throw new SyncV3RequestError(error instanceof Error ? error.message : 'operation.payload.links is invalid.');
+        }
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        const cardCoverAssetId = payload.cardCoverAssetId === undefined
+            ? undefined
+            : payload.cardCoverAssetId === null
+                ? null
+                : typeof payload.cardCoverAssetId === 'string' && payload.cardCoverAssetId.trim()
+                    ? payload.cardCoverAssetId.trim()
+                    : (() => { throw new SyncV3RequestError('operation.payload.cardCoverAssetId must be a string or null.'); })();
+        return { ...common, operation: {
+                domain: 'task-attachment-links', entityId, mutationKind: 'replace', baseEntityRevision,
+                baseLifecycleRevision: '0',
+                payload: {
+                    links,
+                    ...(cardCoverAssetId !== undefined ? { cardCoverAssetId } : {}),
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'entity-event'
+        && operation.mutationKind === 'adopt-legacy-batch') {
+        if (!isLegacyEntityEventAdoptionIdentity({ clientId, operationId })) {
+            throw new SyncV3RequestError('Legacy entity-event adoption identity is invalid.');
+        }
+        if (baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Legacy entity-event adoption lifecycle revision must be 0.');
+        }
+        assertExactKeys(payload, ['events'], 'operation.payload');
+        let events;
+        try {
+            events = validateEntityEventLegacyAdoptionBatch({
+                workspaceId: common.workspaceId,
+                events: payload.events,
+            });
+        }
+        catch (error) {
+            throw new SyncV3RequestError(error instanceof Error
+                ? error.message
+                : 'operation.payload.events is invalid.');
+        }
+        if (entityId !== events[0].id) {
+            throw new SyncV3RequestError('Legacy entity-event adoption entityId must match the first event.');
+        }
+        return {
+            ...common,
+            operation: {
+                domain: 'entity-event',
+                entityId,
+                mutationKind: 'adopt-legacy-batch',
+                baseEntityRevision,
+                baseLifecycleRevision: '0',
+                payload: { events },
+            },
+        };
+    }
+    if (operation.domain === 'task-relationship' && (operation.mutationKind === 'link' || operation.mutationKind === 'unlink')) {
+        const hasAdoptedRelationship = Object.prototype.hasOwnProperty.call(payload, 'adoptedRelationship');
+        assertExactKeys(payload, hasAdoptedRelationship
+            ? ['sourceTaskId', 'targetTaskId', 'type', 'adoptedRelationship']
+            : ['sourceTaskId', 'targetTaskId', 'type'], 'operation.payload');
+        const adoptedRelationship = hasAdoptedRelationship
+            ? requireObject(payload.adoptedRelationship, 'operation.payload.adoptedRelationship')
+            : null;
+        if (adoptedRelationship) {
+            assertExactKeys(adoptedRelationship, [
+                'id', 'workspaceId', 'sourceTaskId', 'targetTaskId', 'kind',
+                'createdBy', 'createdAt', 'updatedBy', 'updatedAt', 'deletedBy', 'deletedAt',
+            ], 'operation.payload.adoptedRelationship');
+        }
+        return { ...common, operation: {
+                domain: 'task-relationship',
+                entityId,
+                mutationKind: operation.mutationKind,
+                baseEntityRevision,
+                baseLifecycleRevision,
+                payload: {
+                    sourceTaskId: requireId(payload.sourceTaskId, 'operation.payload.sourceTaskId'),
+                    targetTaskId: requireId(payload.targetTaskId, 'operation.payload.targetTaskId'),
+                    type: requireRelationshipType(payload.type),
+                    ...(adoptedRelationship ? {
+                        adoptedRelationship: adoptedRelationship,
+                    } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'taxonomy' && operation.mutationKind === 'replace-state-with-task-remaps') {
+        if (entityId !== '__taxonomy_config__') {
+            throw new SyncV3RequestError('Taxonomy entityId must be __taxonomy_config__.');
+        }
+        if (baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Taxonomy lifecycle revision must be 0.');
+        }
+        assertExactKeys(payload, ['state', 'taskPatches'], 'operation.payload');
+        const state = validateCanonicalTaxonomyState(payload.state);
+        if (!Array.isArray(payload.taskPatches)) {
+            throw new SyncV3RequestError('operation.payload.taskPatches must be an array.');
+        }
+        const taskPatches = payload.taskPatches.map((raw, index) => {
+            const entry = requireObject(raw, `operation.payload.taskPatches[${index}]`);
+            assertExactKeys(entry, ['entityId', 'baseEntityRevision', 'baseLifecycleRevision', 'patch'], `operation.payload.taskPatches[${index}]`);
+            const patch = requireObject(entry.patch, `operation.payload.taskPatches[${index}].patch`);
+            return {
+                entityId: requireId(entry.entityId, `operation.payload.taskPatches[${index}].entityId`),
+                baseEntityRevision: requireRevision(entry.baseEntityRevision, `operation.payload.taskPatches[${index}].baseEntityRevision`),
+                baseLifecycleRevision: requireRevision(entry.baseLifecycleRevision, `operation.payload.taskPatches[${index}].baseLifecycleRevision`),
+                patch,
+            };
+        });
+        return { ...common, operation: {
+                domain: 'taxonomy', entityId: '__taxonomy_config__',
+                mutationKind: 'replace-state-with-task-remaps',
+                baseEntityRevision, baseLifecycleRevision: '0',
+                payload: { state, taskPatches: validateTaxonomyTaskRemapPatches(taskPatches, state) },
+            } };
+    }
+    if (operation.domain === 'taxonomy' && operation.mutationKind === 'replace-state') {
+        if (entityId !== '__taxonomy_config__') {
+            throw new SyncV3RequestError('Taxonomy entityId must be __taxonomy_config__.');
+        }
+        if (baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Taxonomy lifecycle revision must be 0.');
+        }
+        assertExactKeys(payload, ['state'], 'operation.payload');
+        return { ...common, operation: {
+                domain: 'taxonomy', entityId: '__taxonomy_config__', mutationKind: 'replace-state',
+                baseEntityRevision, baseLifecycleRevision: '0',
+                payload: { state: validateCanonicalTaxonomyState(payload.state) },
+            } };
+    }
+    if (operation.domain === 'initiative' && operation.mutationKind === 'create') {
+        if (baseEntityRevision !== '0' || baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Initiative create base revisions must both be 0.');
+        }
+        return { ...common, operation: {
+                domain: 'initiative', entityId, mutationKind: 'create',
+                baseEntityRevision: '0', baseLifecycleRevision: '0',
+                payload: validateDurableInitiativeCreatePayload(payload),
+            } };
+    }
+    if (operation.domain === 'initiative' && operation.mutationKind === 'metadata-update') {
+        assertExactKeys(payload, ['patch'], 'operation.payload');
+        return { ...common, operation: {
+                domain: 'initiative', entityId, mutationKind: 'metadata-update', baseEntityRevision, baseLifecycleRevision,
+                payload: { patch: validateDurableInitiativeMetadataPatch(payload.patch) },
+            } };
+    }
+    if (operation.domain === 'initiative' && operation.mutationKind === 'append-comment') {
+        assertExactKeys(payload, payload.originActor === undefined ? ['comment'] : ['comment', 'originActor'], 'operation.payload');
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'initiative', entityId, mutationKind: 'append-comment', baseEntityRevision, baseLifecycleRevision,
+                payload: {
+                    comment: validateDurableInitiativeComment(payload.comment),
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'initiative' && (operation.mutationKind === 'archive' || operation.mutationKind === 'unarchive')) {
+        return { ...common, operation: {
+                domain: 'initiative', entityId, mutationKind: operation.mutationKind, baseEntityRevision, baseLifecycleRevision,
+                payload: validateEmptyInitiativePayload(payload, `Initiative ${operation.mutationKind} payload`),
+            } };
+    }
+    if (operation.domain === 'workstream' && operation.mutationKind === 'create') {
+        if (baseEntityRevision !== '0' || baseLifecycleRevision !== '0') {
+            throw new SyncV3RequestError('Workstream create base revisions must both be 0.');
+        }
+        return { ...common, operation: {
+                domain: 'workstream', entityId, mutationKind: 'create',
+                baseEntityRevision: '0', baseLifecycleRevision: '0',
+                payload: validateDurableWorkstreamCreatePayload(payload),
+            } };
+    }
+    if (operation.domain === 'workstream' && operation.mutationKind === 'metadata-update') {
+        assertExactKeys(payload, ['patch'], 'operation.payload');
+        return { ...common, operation: {
+                domain: 'workstream', entityId, mutationKind: 'metadata-update', baseEntityRevision, baseLifecycleRevision,
+                payload: { patch: validateDurableWorkstreamMetadataPatch(payload.patch) },
+            } };
+    }
+    if (operation.domain === 'workstream' && operation.mutationKind === 'append-comment') {
+        assertExactKeys(payload, payload.originActor === undefined ? ['comment'] : ['comment', 'originActor'], 'operation.payload');
+        const originActor = payload.originActor === undefined
+            ? undefined
+            : requireOriginActor(payload.originActor);
+        return { ...common, operation: {
+                domain: 'workstream', entityId, mutationKind: 'append-comment', baseEntityRevision, baseLifecycleRevision,
+                payload: {
+                    comment: validateDurableWorkstreamComment(payload.comment),
+                    ...(originActor ? { originActor } : {}),
+                },
+            } };
+    }
+    if (operation.domain === 'workstream' && (operation.mutationKind === 'archive' || operation.mutationKind === 'unarchive')) {
+        return { ...common, operation: {
+                domain: 'workstream', entityId, mutationKind: operation.mutationKind, baseEntityRevision, baseLifecycleRevision,
+                payload: validateEmptyWorkstreamPayload(payload, `Workstream ${operation.mutationKind} payload`),
+            } };
+    }
+    throw new SyncV3RequestError('operation domain and mutationKind are not supported.');
+}
+export function isWorkspaceSyncV3TasksEnabled(env = process.env) {
+    return /^(1|true|on|yes)$/i.test(String(env.TASKFORCE_SYNC_V3_TASKS_ENABLED || '').trim());
+}
+export function isWorkspaceSyncV3TaskStatusEnabled(env = process.env) {
+    return /^(1|true|on|yes)$/i.test(String(env.TASKFORCE_SYNC_V3_TASK_STATUS_ENABLED || '').trim());
+}
+export function isWorkspaceSyncV3TaskCommentsEnabled(env = process.env) {
+    return /^(1|true|on|yes)$/i.test(String(env.TASKFORCE_SYNC_V3_TASK_COMMENTS_ENABLED || '').trim());
+}
+export function isWorkspaceSyncV3TaskChecklistEnabled(env = process.env) {
+    return /^(1|true|on|yes)$/i.test(String(env.TASKFORCE_SYNC_V3_TASK_CHECKLIST_ENABLED || '').trim());
+}
+export function isWorkspaceSyncV3TaskAttachmentLinksEnabled(env = process.env) {
+    return /^(1|true|on|yes)$/i.test(String(env.TASKFORCE_SYNC_V3_TASK_ATTACHMENT_LINKS_ENABLED || '').trim());
+}
+export function isWorkspaceSyncV3TaxonomyEnabled(env = process.env) {
+    return /^(1|true|on|yes)$/i.test(String(env.TASKFORCE_SYNC_V3_TAXONOMY_ENABLED || '').trim());
+}
+export function isWorkspaceSyncV3InitiativesEnabled(env = process.env) {
+    return isWorkspaceSyncV3PlanningCloudEnabled('initiative', env);
+}
+export function isWorkspaceSyncV3WorkstreamsEnabled(env = process.env) {
+    return isWorkspaceSyncV3PlanningCloudEnabled('workstream', env);
+}
+export function registerWorkspaceSyncV3OperationRoutes(input) {
+    const enabled = input.enabled ?? isWorkspaceSyncV3TasksEnabled();
+    const statusEnabled = input.statusEnabled ?? isWorkspaceSyncV3TaskStatusEnabled();
+    const commentsEnabled = input.commentsEnabled ?? isWorkspaceSyncV3TaskCommentsEnabled();
+    const checklistEnabled = input.checklistEnabled ?? isWorkspaceSyncV3TaskChecklistEnabled();
+    const attachmentLinksEnabled = input.attachmentLinksEnabled ?? isWorkspaceSyncV3TaskAttachmentLinksEnabled();
+    const taxonomyEnabled = input.taxonomyEnabled ?? isWorkspaceSyncV3TaxonomyEnabled();
+    const initiativeEnabled = input.initiativeEnabled ?? isWorkspaceSyncV3InitiativesEnabled();
+    const workstreamEnabled = input.workstreamEnabled ?? isWorkspaceSyncV3WorkstreamsEnabled();
+    const workflowRuntimeEnabled = input.workflowRuntimeEnabled ?? resolveWorkflowRuntimeMutationCapability({
+        runtimeMode: 'cloud',
+        surface: 'http',
+        env: input.env,
+    });
+    const now = input.now || (() => new Date());
+    const operationHandlers = createWorkspaceSyncV3CloudOperationHandlers();
+    input.addRoute('POST', ROUTE_PATH, async (req, res) => {
+        if (!enabled && !commentsEnabled && !checklistEnabled && !attachmentLinksEnabled
+            && !taxonomyEnabled && !initiativeEnabled && !workstreamEnabled && !workflowRuntimeEnabled) {
+            writeJson(res, 404, {
+                success: false,
+                error: 'Not found.',
+                code: 'WORKSPACE_SYNC_V3_DISABLED',
+            });
+            return;
+        }
+        const store = new WorkspaceSyncDurabilityStore(input.core.getDatabaseAdapter());
+        const authConfig = input.context.authConfig;
+        if (!requireEnabledSyncAuth(res, authConfig))
+            return;
+        const access = requireAuthenticatedSyncRequest({
+            req,
+            res,
+            authConfig,
+            resolveRequestAccess: input.resolveRequestAccess,
+            auditAuthAction: input.auditAuthAction,
+            unauthorizedAuditAction: 'sync-v3-operation-unauthorized',
+        });
+        if (!access)
+            return;
+        let auditEnvelope = null;
+        let auditWorkspaceId = null;
+        let auditContentActorId = String(access.userId || '');
+        let auditContentActorIds = [];
+        let auditBindingSource = 'authorization-actor';
+        try {
+            const envelope = parseWorkspaceSyncV3OperationEnvelope(await parseJsonBody(req, MAX_BODY_BYTES));
+            auditEnvelope = envelope;
+            if (envelope.operation.domain === 'task-comments'
+                && envelope.operation.mutationKind === 'reconcile') {
+                auditContentActorId = '';
+                auditBindingSource = 'reconcile-provenance-pending';
+            }
+            if (envelope.operation.domain === 'taxonomy' && !taxonomyEnabled) {
+                writeJson(res, 404, {
+                    success: false,
+                    error: 'Not found.',
+                    code: 'WORKSPACE_SYNC_V3_TAXONOMY_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'initiative' && !initiativeEnabled) {
+                writeJson(res, 404, {
+                    success: false,
+                    error: 'Not found.',
+                    code: 'WORKSPACE_SYNC_V3_INITIATIVE_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'workstream' && !workstreamEnabled) {
+                writeJson(res, 404, {
+                    success: false,
+                    error: 'Not found.',
+                    code: 'WORKSPACE_SYNC_V3_WORKSTREAM_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'workflow-execution' && !workflowRuntimeEnabled) {
+                writeJson(res, 404, {
+                    success: false,
+                    error: 'Not found.',
+                    code: 'WORKSPACE_SYNC_V3_WORKFLOW_RUNTIME_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain !== 'taxonomy'
+                && envelope.operation.domain !== 'initiative'
+                && envelope.operation.domain !== 'workstream'
+                && envelope.operation.domain !== 'task-comments'
+                && envelope.operation.domain !== 'task-checklist'
+                && envelope.operation.domain !== 'task-attachment-links'
+                && envelope.operation.domain !== 'workflow-execution'
+                && !enabled) {
+                writeJson(res, 404, {
+                    success: false,
+                    error: 'Not found.',
+                    code: 'WORKSPACE_SYNC_V3_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'task' && envelope.operation.mutationKind === 'set-status' && !statusEnabled) {
+                writeJson(res, 404, {
+                    success: false,
+                    error: 'Not found.',
+                    code: 'WORKSPACE_SYNC_V3_TASK_STATUS_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'task-comments' && !commentsEnabled) {
+                writeJson(res, 404, {
+                    success: false, error: 'Not found.', code: 'WORKSPACE_SYNC_V3_TASK_COMMENTS_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'task-checklist' && !checklistEnabled) {
+                writeJson(res, 404, {
+                    success: false, error: 'Not found.', code: 'WORKSPACE_SYNC_V3_TASK_CHECKLIST_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'task-attachment-links' && !attachmentLinksEnabled) {
+                writeJson(res, 404, {
+                    success: false, error: 'Not found.', code: 'WORKSPACE_SYNC_V3_TASK_ATTACHMENT_LINKS_DISABLED',
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'task' && envelope.operation.mutationKind === 'create'
+                && 'task' in envelope.operation.payload && envelope.operation.payload.attachments !== undefined
+                && !attachmentLinksEnabled) {
+                writeJson(res, 404, {
+                    error: 'Workspace sync v3 task attachment links are disabled.',
+                    code: 'WORKSPACE_SYNC_V3_TASK_ATTACHMENT_LINKS_DISABLED',
+                });
+                return;
+            }
+            const workspaceId = resolveAuthorizedSyncWorkspace({
+                req,
+                res,
+                core: input.core,
+                access,
+                requestedWorkspaceId: envelope.workspaceId,
+                auditAuthAction: input.auditAuthAction,
+                missingWorkspaceAuditAction: 'sync-v3-operation-workspace-required',
+                forbiddenWorkspaceAuditAction: 'sync-v3-operation-workspace-forbidden',
+            });
+            if (!workspaceId)
+                return;
+            auditWorkspaceId = workspaceId;
+            const userAccess = input.core.resolveUserAccess(String(access.userId), workspaceId, 'member');
+            if (!userAccess
+                || userAccess.disabled
+                || userAccess.role === 'read-only'
+                || userAccess.permissionMode === 'read-only') {
+                input.auditAuthAction(req, 'sync-v3-operation-write-forbidden', {
+                    workspaceId,
+                    userId: access.userId,
+                });
+                writeJson(res, 403, {
+                    success: false,
+                    error: 'Write access to this workspace is required.',
+                    code: 'WORKSPACE_WRITE_ACCESS_DENIED',
+                });
+                return;
+            }
+            const acceptedAt = now();
+            const acceptedAtIso = acceptedAt.toISOString();
+            const common = {
+                store,
+                core: input.core,
+                tenantId: input.core.getTenantId(),
+                workspaceId,
+                clientId: envelope.clientId,
+                operationId: envelope.operationId,
+                now: acceptedAtIso,
+                leaseExpiresAt: new Date(acceptedAt.getTime() + OPERATION_LEASE_MS).toISOString(),
+                actorRef: String(access.userId),
+                resolveTaskCommentReconcileActor: (comment, provenance) => {
+                    if (provenance.commentId !== comment.id) {
+                        throw new SyncV3RequestError('Task comment reconciliation provenance identity is invalid.');
+                    }
+                    if (provenance.actor.kind === 'authorization-actor') {
+                        const authorizationActor = String(access.userId);
+                        if (provenance.actor.actorRef !== authorizationActor
+                            && provenance.actor.actorRef !== 'user') {
+                            throw new SyncV3RequestError('Task comment reconciliation authorization actor does not match the request.');
+                        }
+                        return authorizationActor;
+                    }
+                    if (provenance.actor.kind === 'authoritative-entity-event') {
+                        const evidence = input.core.getTaskEventForSync({
+                            workspaceId,
+                            taskId: envelope.operation.entityId,
+                            eventId: provenance.actor.eventId,
+                        });
+                        const details = evidence?.details;
+                        if (!evidence
+                            || evidence.workspaceId !== workspaceId
+                            || evidence.entityType !== 'task'
+                            || evidence.entityId !== envelope.operation.entityId
+                            || evidence.taskId !== envelope.operation.entityId
+                            || evidence.action !== 'task-comment-added'
+                            || !details
+                            || Object.keys(details).sort().join(',')
+                                !== 'commentId,preview,submittedAuthor'
+                            || details.commentId !== comment.id
+                            || details.preview !== comment.text.slice(0, 160)
+                            || details.submittedAuthor
+                                !== String(comment.submittedAuthor || comment.author || '').trim()
+                            || evidence.actor !== comment.author) {
+                            throw new SyncV3RequestError('Task comment reconciliation entity-event provenance is invalid.');
+                        }
+                        return evidence.actor;
+                    }
+                    const aiActor = provenance.actor;
+                    const storedProfile = input.core.listAiProfiles(workspaceId, { includeArchived: true })
+                        .find((candidate) => candidate.id === aiActor.profileId);
+                    if (!storedProfile)
+                        throw new SyncV3DependencyPendingError();
+                    if (!isStrongWorkspaceSyncV3OriginAssertionProfileToken(storedProfile.profileToken)) {
+                        throw new SyncV3DependencyPendingError();
+                    }
+                    if (storedProfile.archivedAt) {
+                        throw new SyncV3RequestError('Task comment reconciliation actor is archived and cannot author new mutations.');
+                    }
+                    if (storedProfile.seatScope !== 'local_unmetered') {
+                        throw new SyncV3RequestError('Task comment reconciliation actor is not an active local AI profile.');
+                    }
+                    if (!verifyWorkspaceSyncV3TaskCommentReconcileProvenance({
+                        workspaceId,
+                        clientId: envelope.clientId,
+                        operationId: envelope.operationId,
+                        taskId: envelope.operation.entityId,
+                        comment,
+                        provenance,
+                        profileToken: storedProfile.profileToken,
+                    })) {
+                        throw new SyncV3RequestError('Task comment reconciliation provenance assertion is invalid.');
+                    }
+                    return storedProfile.id;
+                },
+                resolveOriginActorRef: (originActor) => {
+                    const activeProfile = input.core.listAiProfiles(workspaceId)
+                        .find((candidate) => candidate.id === originActor.profileId);
+                    const storedProfile = activeProfile
+                        || input.core.listAiProfiles(workspaceId, { includeArchived: true })
+                            .find((candidate) => candidate.id === originActor.profileId);
+                    const binding = workspaceSyncV3OriginAssertionBinding({
+                        tenantId: input.core.getTenantId(),
+                        envelope,
+                        originActor,
+                    });
+                    const auditOriginRejection = (reasonCode) => {
+                        auditBindingSource = 'origin-assertion-rejected';
+                        auditContentActorId = '';
+                        input.auditAuthAction(req, 'sync-v3-origin-assertion-rejected', {
+                            workspaceId,
+                            clientId: envelope.clientId,
+                            operationId: envelope.operationId,
+                            domain: envelope.operation.domain,
+                            entityId: envelope.operation.entityId,
+                            mutationKind: envelope.operation.mutationKind,
+                            profileId: originActor.profileId,
+                            outcome: 'rejected',
+                            reasonCode,
+                        });
+                    };
+                    if (!storedProfile) {
+                        auditOriginRejection('profile-not-synced');
+                        throw new SyncV3DependencyPendingError();
+                    }
+                    if (!isStrongWorkspaceSyncV3OriginAssertionProfileToken(storedProfile.profileToken)) {
+                        auditOriginRejection('profile-token-pending');
+                        throw new SyncV3DependencyPendingError();
+                    }
+                    if (!binding) {
+                        auditOriginRejection('binding-invalid');
+                        throw new SyncV3RequestError('Operation origin assertion binding is invalid.');
+                    }
+                    const verification = verifyWorkspaceSyncV3OriginAssertion({
+                        assertion: req.headers[WORKSPACE_SYNC_V3_ORIGIN_ASSERTION_HEADER],
+                        binding,
+                        profileToken: storedProfile.profileToken,
+                        now: acceptedAt,
+                    });
+                    if (!verification.verified) {
+                        auditOriginRejection(verification.reason);
+                        throw new SyncV3RequestError('Operation origin assertion is missing, invalid, or expired.');
+                    }
+                    if (storedProfile.archivedAt) {
+                        auditOriginRejection('profile-archived');
+                        throw new SyncV3RequestError('Operation origin actor is archived and cannot author new mutations.');
+                    }
+                    if (storedProfile.seatScope !== 'local_unmetered') {
+                        auditOriginRejection('profile-seat-scope');
+                        throw new SyncV3RequestError('Operation origin actor is not an active local AI profile in this workspace.');
+                    }
+                    auditBindingSource = 'signed-origin-assertion';
+                    auditContentActorId = storedProfile.id;
+                    return storedProfile.id;
+                },
+                onPostCommitError: (error) => input.auditAuthAction(req, 'sync-v3-operation-post-commit-effect-failed', {
+                    workspaceId,
+                    operationId: envelope.operationId,
+                    errorCode: String(error?.code || 'POST_COMMIT_EFFECT_FAILED').slice(0, 100),
+                }),
+            };
+            const operationWasCommitted = Boolean(store.readCommittedOperationResponse({
+                tenantId: input.core.getTenantId(),
+                workspaceId,
+                clientId: envelope.clientId,
+                operationId: envelope.operationId,
+            }));
+            const result = dispatchWorkspaceSyncV3CloudOperation({
+                handlers: operationHandlers,
+                envelope,
+                context: common,
+            });
+            if (result.state === 'in_progress') {
+                writeJson(res, 409, {
+                    success: false,
+                    error: 'The operation is already in progress.',
+                    code: 'WORKSPACE_SYNC_OPERATION_IN_PROGRESS',
+                    retryAt: result.retryAt,
+                    retryAfterMs: Math.max(0, Date.parse(result.retryAt) - acceptedAt.getTime()),
+                });
+                return;
+            }
+            if (envelope.operation.domain === 'task-comments'
+                && envelope.operation.mutationKind === 'reconcile') {
+                auditContentActorId = '';
+                auditContentActorIds = committedResponseContentActors(result.responseJson);
+                auditBindingSource = operationWasCommitted
+                    ? 'committed-response'
+                    : 'verified-reconcile-provenance';
+            }
+            else if (operationWasCommitted) {
+                auditBindingSource = 'committed-response';
+                auditContentActorId = committedResponseContentActor(result.responseJson) || '';
+            }
+            input.auditAuthAction(req, 'sync-v3-operation-succeeded', {
+                workspaceId,
+                clientId: envelope.clientId,
+                operationId: envelope.operationId,
+                domain: envelope.operation.domain,
+                entityId: envelope.operation.entityId,
+                mutationKind: envelope.operation.mutationKind,
+                ...(auditContentActorId ? { contentActorId: auditContentActorId } : {}),
+                ...(auditContentActorIds.length > 0 ? { contentActorIds: auditContentActorIds } : {}),
+                authorizationActorId: String(access.userId),
+                bindingSource: auditBindingSource,
+                outcome: operationWasCommitted ? 'replayed' : 'committed',
+            });
+            res.writeHead(200, { 'Content-Type': 'application/json' });
+            res.end(result.responseJson);
+        }
+        catch (error) {
+            let statusCode = 500;
+            let code = 'WORKSPACE_SYNC_V3_INTERNAL_ERROR';
+            let message = 'Failed to apply workspace sync operation.';
+            if (error instanceof SyncV3RequestError
+                || error instanceof DurableTaskMetadataMutationError
+                || error instanceof DurableTaskCreateMutationError
+                || error instanceof DurableTaskDeleteMutationError
+                || error instanceof DurableTaskRestoreMutationError
+                || error instanceof DurableTaskLifecycleMutationError
+                || error instanceof DurableTaskRelationshipMutationError
+                || error instanceof DurableTaskWorkflowMutationError
+                || error instanceof DurableTaskStatusMutationError
+                || error instanceof WorkflowTaskActivationError
+                || error instanceof WorkflowAssignmentSyncError
+                || error instanceof DurableTaskCommentMutationError
+                || error instanceof DurableTaskChecklistMutationError
+                || error instanceof DurableTaskAttachmentLinksMutationError
+                || error instanceof TaskLegacyRootAdoptionError
+                || error instanceof TaskRelationshipLegacyAdoptionError
+                || error instanceof EntityEventLegacyAdoptionError
+                || error instanceof DurableTaxonomyMutationError
+                || error instanceof DurableInitiativeMutationError
+                || error instanceof DurableInitiativeApplyError
+                || error instanceof DurableWorkstreamMutationError
+                || error instanceof DurableWorkstreamApplyError) {
+                statusCode = error.statusCode;
+                code = error.code;
+                message = error.message;
+            }
+            else if (error instanceof WorkspaceSyncIdempotencyConflictError
+                || error instanceof WorkspaceSyncRevisionConflictError
+                || error instanceof EntityEventIdentityCollisionError
+                || error instanceof WorkflowAssignmentSyncConflictError) {
+                statusCode = 409;
+                code = error.code;
+                message = error.message;
+            }
+            else if (error instanceof WorkspaceSyncLeaseLostError) {
+                statusCode = 409;
+                code = error.code;
+                message = error.message;
+            }
+            else if (typeof error?.statusCode === 'number') {
+                statusCode = Number(error.statusCode);
+                code = String(error.code || 'WORKSPACE_SYNC_V3_REJECTED');
+                message = String(error.message || message);
+            }
+            if (statusCode >= 500) {
+                const failure = error instanceof Error
+                    ? { name: error.name, message: error.message, stack: error.stack }
+                    : { name: typeof error, message: String(error) };
+                console.error('[Taskforce Sync V3] operation failed', {
+                    workspaceId: auditWorkspaceId,
+                    clientId: auditEnvelope?.clientId,
+                    operationId: auditEnvelope?.operationId,
+                    domain: auditEnvelope?.operation.domain,
+                    entityId: auditEnvelope?.operation.entityId,
+                    mutationKind: auditEnvelope?.operation.mutationKind,
+                    failure,
+                });
+            }
+            input.auditAuthAction(req, 'sync-v3-operation-failed', {
+                statusCode,
+                code,
+                ...(auditWorkspaceId ? { workspaceId: auditWorkspaceId } : {}),
+                ...(auditEnvelope ? {
+                    clientId: auditEnvelope.clientId,
+                    operationId: auditEnvelope.operationId,
+                    domain: auditEnvelope.operation.domain,
+                    entityId: auditEnvelope.operation.entityId,
+                    mutationKind: auditEnvelope.operation.mutationKind,
+                    authorizationActorId: String(access.userId),
+                    contentActorId: auditContentActorId,
+                    ...(auditContentActorIds.length > 0 ? { contentActorIds: auditContentActorIds } : {}),
+                    bindingSource: auditBindingSource,
+                } : {}),
+                outcome: 'failed',
+            });
+            writeJson(res, statusCode, { success: false, error: message, code });
+        }
+    });
+}