engineering-memory 0.1.0

package/runtime/dist/src/runtime/bridge-service.js

@@ -0,0 +1,2226 @@
+import { randomUUID } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { minimatch } from 'minimatch';
+import { endpoints } from '../config.js';
+import { sha256, stableStringify } from '../utilities/hash.js';
+import { ApiResponseError, BackendUnavailableError, } from './api-client.js';
+import { assertSafeToPersist, normalizeRepositoryPaths } from './offline-outbox.js';
+export const validationIds = [
+    'format',
+    'static_analysis',
+    'tests',
+    'build',
+    'codegen',
+    'localization',
+    'ui',
+    'network',
+    'structure',
+    'diff_check',
+    'privacy_scan',
+    'read_only_integrity',
+    'dependency_audit',
+    'deploy_smoke',
+];
+export class BridgeService {
+    dependencies;
+    taskQueues = new Map();
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+    }
+    async sessionBootstrap(input) {
+        return await this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd(), input.projectId);
+            const persistedBootstrap = normalizePersistentInput({
+                externalTaskId: input.externalTaskId,
+                objective: input.objective,
+                taskKind: input.taskKind,
+                mode: input.mode,
+                knownRevisions: input.knownRevisions,
+            }, repository.repoRoot);
+            assertSafeToPersist(cleanJson(persistedBootstrap));
+            const authentication = await this.dependencies.browserAuth.ensureAuthenticated();
+            if (authentication) {
+                return asJsonValue({ authentication, repository: publicRepository(repository) });
+            }
+            const recoveredDeliveries = await this.recoverJournalOutbox();
+            const outbox = await this.flushOutbox();
+            let projectId = repository.projectId;
+            if (!repository.markerPath) {
+                const resolved = await this.dependencies.client.request(endpoints.projectResolve, {
+                    method: 'POST',
+                    body: { repoFingerprint: repository.repoFingerprint },
+                });
+                const project = objectValue(resolved.data);
+                const projects = await this.dependencies.client.request(endpoints.projectList);
+                return asJsonValue({
+                    projectBindingRequired: true,
+                    candidate: project,
+                    requestedProjectId: projectId,
+                    repository: publicRepository(repository),
+                    projects: projects.data,
+                    outbox: { recoveredDeliveries, ...objectOrEmpty(outbox) },
+                });
+            }
+            if (!projectId) {
+                throw new Error('Repository marker does not contain a project binding');
+            }
+            const checkpointId = deterministicUuid('session.bootstrap', projectId, repository.repoFingerprint, input.externalTaskId);
+            const response = await this.dependencies.client.request(endpoints.sessionBootstrap, {
+                method: 'POST',
+                idempotencyKey: checkpointId,
+                body: cleanJson({
+                    projectId,
+                    externalTaskId: persistedBootstrap.externalTaskId,
+                    objective: persistedBootstrap.objective,
+                    taskKind: persistedBootstrap.taskKind,
+                    mode: persistedBootstrap.mode ?? 'write',
+                    repoFingerprint: repository.repoFingerprint,
+                    ...(input.mode === 'read_only' ? { baselineDiffHash: repository.git.diffHash } : {}),
+                    checkpointIdempotencyKey: checkpointId,
+                    knownRevisions: persistedBootstrap.knownRevisions,
+                }),
+            });
+            const data = objectValue(response.data);
+            const task = objectValue(data?.task);
+            const session = objectValue(data?.session);
+            const checkpoint = objectValue(data?.checkpoint);
+            const checkpointEvent = objectValue(checkpoint?.event);
+            const checkpointPayload = objectValue(checkpointEvent?.payload);
+            if (!data ||
+                !task ||
+                !session ||
+                !checkpointEvent ||
+                typeof task.id !== 'string' ||
+                typeof session.id !== 'string' ||
+                checkpointEvent.idempotencyKey !== checkpointId ||
+                typeof checkpointPayload?.createdAt !== 'string' ||
+                !isIsoTimestamp(checkpointPayload.createdAt)) {
+                throw new Error('Session bootstrap response is missing canonical checkpoint data');
+            }
+            const pointer = {
+                repoFingerprint: repository.repoFingerprint,
+                projectId,
+                taskId: task.id,
+                taskSlug: input.externalTaskId,
+                sessionId: session.id,
+                lastSequence: numericSequence(task.lastSequence),
+                taskVersion: numericTaskVersion(task.lockVersion),
+                resumeConflicts: [],
+            };
+            await this.dependencies.activeContexts.save(pointer);
+            await this.dependencies.journal.apply({
+                eventId: checkpointId,
+                taskId: task.id,
+                projectId,
+                taskSlug: input.externalTaskId,
+                checkpointType: 'bootstrap',
+                summary: 'Engineering Memory context bootstrapped',
+                documents: {
+                    state: {
+                        objective: persistedBootstrap.objective,
+                        phase: 'bootstrap',
+                        nextAction: 'Complete discovery and record the discovery checkpoint',
+                        forbiddenActions: ['Commit, push, publish or close before task verification passes'],
+                    },
+                },
+                createdAt: checkpointPayload.createdAt,
+            });
+            await this.seedResumeSnapshot(pointer, data);
+            return asJsonValue({
+                ...data,
+                repository: publicRepository(repository),
+                localJournal: await this.dependencies.journal.load(projectId, input.externalTaskId),
+                outbox: { recoveredDeliveries, ...objectOrEmpty(outbox) },
+            });
+        });
+    }
+    async sessionResume(input) {
+        return await this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd(), input.projectId);
+            const authentication = await this.dependencies.browserAuth.ensureAuthenticated();
+            if (authentication) {
+                return asJsonValue({ authentication, repository: publicRepository(repository) });
+            }
+            let pointer = await this.dependencies.activeContexts.load(repository.repoFingerprint);
+            const projectId = input.projectId ?? repository.projectId ?? pointer?.projectId;
+            const taskSlug = input.taskSlug ?? pointer?.taskSlug;
+            const sessionId = input.sessionId ?? pointer?.sessionId;
+            if (!projectId || !taskSlug || !sessionId) {
+                throw new Error('No active Engineering Memory task is available for this repository');
+            }
+            if ((pointer &&
+                (pointer.projectId !== projectId ||
+                    pointer.taskSlug !== taskSlug ||
+                    pointer.sessionId !== sessionId)) ||
+                (repository.projectId && repository.projectId !== projectId)) {
+                throw new Error('Active task pointer does not match the repository project binding');
+            }
+            if (pointer?.closeIntent) {
+                const recoveredClose = await this.retryCloseIntent(repository, pointer);
+                return asJsonValue({
+                    backend: { close: recoveredClose },
+                    repository: publicRepository(repository),
+                    localJournal: await this.dependencies.journal.load(projectId, taskSlug),
+                    synchronization: {
+                        taskClosed: true,
+                        recoveredCloseAfterResponseLoss: true,
+                        editLeaseAllowed: false,
+                        offlineDevelopmentOnly: false,
+                    },
+                });
+            }
+            const recoveredDeliveries = await this.recoverJournalOutbox(projectId, taskSlug);
+            const outbox = await this.flushOutbox();
+            const afterSequence = input.afterSequence ?? 0;
+            const response = await this.dependencies.client.request(endpoints.sessionResume, {
+                method: 'POST',
+                cacheKey: resumeCacheKey(sessionId, repository.repoFingerprint, afterSequence),
+                allowStaleOnUnavailable: true,
+                body: {
+                    sessionId,
+                    repoFingerprint: repository.repoFingerprint,
+                    afterSequence,
+                },
+            });
+            const backend = objectValue(response.data);
+            const backendTask = objectValue(backend?.task);
+            const backendSession = objectValue(backend?.session);
+            if (!backend ||
+                !backendTask ||
+                !backendSession ||
+                typeof backendTask.id !== 'string' ||
+                typeof backendSession.id !== 'string' ||
+                backendSession.id !== sessionId) {
+                throw new Error('Session resume response is missing the active task snapshot');
+            }
+            let localJournal = await this.dependencies.journal.load(projectId, taskSlug);
+            let pendingOutbox = await this.dependencies.outbox.list();
+            const responseSource = this.dependencies.client.getResponseSource(response);
+            const recoveredVerification = responseSource !== 'stale_cache' && pointer
+                ? await this.retryVerificationRecovery(repository, pointer, backend)
+                : null;
+            if (recoveredVerification) {
+                pointer = await this.dependencies.activeContexts.load(repository.repoFingerprint);
+            }
+            let hydratedFromBackend = false;
+            let mergedFromBackend = false;
+            let blockedJournalEventIds = [];
+            const backendEvents = Array.isArray(backend.events) ? backend.events : [];
+            const backendDocuments = Array.isArray(backend.documents) ? backend.documents : [];
+            if (responseSource !== 'stale_cache' &&
+                afterSequence === 0 &&
+                backendEvents.length === numericSequence(backendTask.lastSequence) &&
+                backendDocuments.length === 5) {
+                const hadLocalProjection = Boolean(localJournal.projection);
+                const hydration = await this.dependencies.journal.hydrateFromBackend({
+                    projectId,
+                    taskId: backendTask.id,
+                    taskSlug,
+                    lastSequence: numericSequence(backendTask.lastSequence),
+                    taskVersion: numericTaskVersion(backendTask.lockVersion),
+                    events: backendEvents,
+                    documents: backendDocuments,
+                });
+                blockedJournalEventIds = hydration.blockedEventIds;
+                const entries = await this.dependencies.outbox.list();
+                for (const eventId of hydration.synchronizedEventIds) {
+                    const entry = entries.find((value) => value.journalRef?.eventId === eventId);
+                    if (entry) {
+                        await this.dependencies.outbox.acknowledge(entry.id);
+                    }
+                }
+                for (const delivery of hydration.pendingDeliveries) {
+                    if (hydration.blockedEventIds.includes(delivery.eventId)) {
+                        continue;
+                    }
+                    const entry = entries.find((value) => value.journalRef?.eventId === delivery.eventId);
+                    if (entry) {
+                        await this.dependencies.outbox.replaceBody(entry.id, delivery.body);
+                    }
+                    else {
+                        await this.dependencies.outbox.enqueue({
+                            operation: delivery.operation,
+                            method: delivery.method,
+                            path: delivery.path,
+                            body: delivery.body,
+                            idempotencyKey: delivery.idempotencyKey,
+                            journalRef: {
+                                projectId: delivery.projectId,
+                                taskSlug: delivery.taskSlug,
+                                eventId: delivery.eventId,
+                            },
+                        });
+                    }
+                }
+                localJournal = await this.dependencies.journal.load(projectId, taskSlug);
+                pendingOutbox = await this.dependencies.outbox.list();
+                hydratedFromBackend = !hadLocalProjection;
+                mergedFromBackend = hadLocalProjection;
+            }
+            const localDocuments = localJournal.projection
+                ? await this.dependencies.journal.readDocuments(projectId, taskSlug)
+                : {};
+            const conflicts = resumeConflicts(backend, backendTask, pointer, localJournal, localDocuments, pendingOutbox, responseSource);
+            const resumedLease = objectValue(backend.activeLease);
+            const resumeIdentityMatches = pointer !== null &&
+                pointer.repoFingerprint === repository.repoFingerprint &&
+                pointer.projectId === projectId &&
+                pointer.taskId === backendTask.id &&
+                pointer.sessionId === sessionId &&
+                backendTask.projectId === projectId &&
+                backendSession.id === sessionId;
+            const offlineDevelopmentAllowed = responseSource === 'stale_cache' &&
+                resumeIdentityMatches &&
+                conflicts.every(isOfflineDevelopmentWarning) &&
+                isOfflineLeaseUsable(resumedLease, sessionId, pointer?.changeBaseline?.leasePaths ?? [], pointer?.changeBaseline?.diffHash);
+            const resumedBaseline = pointer?.taskId === backendTask.id &&
+                pointer.sessionId === sessionId &&
+                pointer.changeBaseline &&
+                (resumedLease?.baselineDiffHash === pointer.changeBaseline.diffHash ||
+                    objectValue(backend.verificationRecovery)?.diffHash === repository.git.diffHash)
+                ? pointer.changeBaseline
+                : undefined;
+            const resumedLastSequence = responseSource === 'stale_cache' && pointer
+                ? Math.max(pointer.lastSequence, numericSequence(backendTask.lastSequence), localJournal.projection?.appliedEventIds.length ?? 0)
+                : numericSequence(backendTask.lastSequence);
+            const resumedTaskVersion = responseSource === 'stale_cache' && pointer
+                ? Math.max(pointer.taskVersion, numericTaskVersion(backendTask.lockVersion))
+                : numericTaskVersion(backendTask.lockVersion);
+            const hasBlockingConflict = conflicts.some((conflict) => !isOfflineDevelopmentWarning(conflict));
+            if (pointer && (!resumeIdentityMatches || hasBlockingConflict)) {
+                await this.dependencies.activeContexts.save({ ...pointer, resumeConflicts: conflicts });
+            }
+            else {
+                await this.dependencies.activeContexts.save({
+                    repoFingerprint: repository.repoFingerprint,
+                    projectId,
+                    taskId: backendTask.id,
+                    taskSlug,
+                    sessionId,
+                    lastSequence: resumedLastSequence,
+                    taskVersion: resumedTaskVersion,
+                    resumeConflicts: conflicts,
+                    ...(resumedBaseline ? { changeBaseline: resumedBaseline } : {}),
+                    ...(pointer?.verificationIntent
+                        ? { verificationIntent: pointer.verificationIntent }
+                        : {}),
+                    ...(pointer?.closeIntent ? { closeIntent: pointer.closeIntent } : {}),
+                });
+            }
+            return asJsonValue({
+                backend,
+                repository: publicRepository(repository),
+                localJournal,
+                synchronization: {
+                    backendSource: responseSource,
+                    backendFresh: responseSource !== 'stale_cache',
+                    hydratedFromBackend,
+                    mergedFromBackend,
+                    blockedJournalEventIds,
+                    recoveredDeliveries,
+                    outbox,
+                    pendingOutboxCount: pendingOutbox.length,
+                    pendingOutbox: pendingOutbox.map((entry) => ({
+                        id: entry.id,
+                        operation: entry.operation,
+                        attempts: entry.attempts,
+                        lastError: entry.lastError,
+                        createdAt: entry.createdAt,
+                    })),
+                    localPendingDeliveryCount: localJournal.pendingDeliveryCount,
+                    conflicts,
+                    requiresAttention: conflicts.length > 0,
+                    editLeaseAllowed: conflicts.length === 0 || offlineDevelopmentAllowed,
+                    offlineDevelopmentOnly: offlineDevelopmentAllowed,
+                    recoveredVerification,
+                },
+            });
+        });
+    }
+    async contextPrepareChange(input) {
+        return await this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+            await this.recoverJournalOutbox();
+            const outbox = await this.flushOutbox();
+            const pendingOutbox = await this.dependencies.outbox.list();
+            const pointer = await this.dependencies.activeContexts.load(repository.repoFingerprint);
+            if (pointer?.verificationIntent || pointer?.closeIntent) {
+                throw new Error('Pending lifecycle intent must be recovered before preparing changes');
+            }
+            const conflicts = [
+                ...(pointer?.resumeConflicts ?? []),
+                ...(pendingOutbox.length > 0 ? ['pending_outbox_delivery'] : []),
+            ];
+            const offlineResume = pointer?.resumeConflicts.includes('backend_resume_is_stale') ?? false;
+            const offlineWarnings = new Set([
+                'backend_resume_is_stale',
+                'pending_outbox_delivery',
+                'pending_local_journal_delivery',
+                'backend_local_sequence_mismatch',
+            ]);
+            const blockingConflicts = conflicts.filter((value) => !(offlineResume &&
+                (offlineWarnings.has(value) || value.startsWith('backend_local_document_mismatch:'))));
+            if (blockingConflicts.length > 0) {
+                return asJsonValue({
+                    editLeaseGranted: false,
+                    conflicts: [...new Set(blockingConflicts)],
+                    outbox,
+                    repository: publicRepository(repository),
+                });
+            }
+            const activeBaseline = pointer?.sessionId === input.sessionId ? pointer.changeBaseline : undefined;
+            const changedPaths = normalizeChangedPaths([
+                ...(activeBaseline?.leasePaths ?? []),
+                ...input.changedPaths,
+            ]);
+            const baselineDiffHash = activeBaseline?.diffHash ?? repository.git.diffHash;
+            let transitionTaskVersion;
+            if (input.transitionToWrite) {
+                if (!pointer || pointer.sessionId !== input.sessionId) {
+                    throw new Error('Read-only transition requires the active repository session');
+                }
+                const refreshed = await this.activeTaskSnapshot(pointer.taskId, pointer.projectId, repository.repoRoot);
+                transitionTaskVersion = refreshed.taskVersion;
+            }
+            const body = cleanJson({
+                sessionId: input.sessionId,
+                changedPaths,
+                baselineDiffHash,
+                ...(input.transitionToWrite
+                    ? { transitionToWrite: true, expectedTaskVersion: transitionTaskVersion }
+                    : {}),
+            });
+            const response = await this.dependencies.client.request(endpoints.contextPrepareChange, {
+                method: 'POST',
+                body,
+                ...(input.transitionToWrite
+                    ? {}
+                    : {
+                        cacheKey: sha256(`context.prepare_change\n${stableStringify(body)}`),
+                        allowStaleOnUnavailable: true,
+                    }),
+            });
+            const responseSource = this.dependencies.client.getResponseSource(response);
+            if (responseSource === 'stale_cache') {
+                validateOfflineLease(response.data, input.sessionId, changedPaths, baselineDiffHash);
+                await this.dependencies.activeContexts.setChangeBaseline(repository.repoFingerprint, input.sessionId, repository.git, changedPaths);
+                return asJsonValue({
+                    ...objectOrEmpty(response.data),
+                    editLeaseGranted: true,
+                    offlineDevelopmentOnly: true,
+                    strictVerifyBlocked: true,
+                    backendSource: responseSource,
+                    conflicts: ['backend_resume_is_stale'],
+                    repository: publicRepository(repository),
+                });
+            }
+            if (pointer?.resumeConflicts.includes('backend_resume_is_stale')) {
+                await this.dependencies.activeContexts.save({
+                    ...pointer,
+                    resumeConflicts: pointer.resumeConflicts.filter((value) => value !== 'backend_resume_is_stale'),
+                });
+            }
+            const preparedTask = objectValue(objectValue(response.data)?.task);
+            await this.dependencies.activeContexts.setChangeBaseline(repository.repoFingerprint, input.sessionId, repository.git, changedPaths, preparedTask &&
+                typeof preparedTask.id === 'string' &&
+                typeof preparedTask.lockVersion === 'number'
+                ? {
+                    taskId: preparedTask.id,
+                    taskVersion: numericTaskVersion(preparedTask.lockVersion),
+                    lastSequence: numericSequence(preparedTask.lastSequence),
+                }
+                : undefined);
+            const preparedPointer = await this.dependencies.activeContexts.load(repository.repoFingerprint);
+            if (preparedPointer) {
+                const preparedData = objectValue(response.data);
+                await this.seedResumeSnapshot(preparedPointer, {
+                    ...objectOrEmpty(response.data),
+                    ...(preparedData?.lease ? { activeLease: preparedData.lease } : {}),
+                });
+            }
+            return asJsonValue({
+                ...objectOrEmpty(response.data),
+                editLeaseGranted: true,
+                offlineDevelopmentOnly: false,
+                strictVerifyBlocked: false,
+                backendSource: responseSource,
+                repository: publicRepository(repository),
+            });
+        });
+    }
+    async contextRefresh(input) {
+        return await this.execute(async () => {
+            const response = await this.dependencies.client.request(endpoints.contextRefresh, {
+                method: 'POST',
+                body: { sessionId: input.sessionId },
+            });
+            await this.dependencies.activeContexts.clearSessionConflict(input.sessionId, 'approved_memory_revision_requires_refresh');
+            return asJsonValue({
+                ...objectOrEmpty(response.data),
+                requiresPrepareChange: true,
+            });
+        });
+    }
+    async memoryQuery(input) {
+        return await this.execute(async () => {
+            const body = cleanJson(input);
+            const response = await this.dependencies.client.request(endpoints.memoryQuery, {
+                method: 'POST',
+                body,
+                cacheKey: sha256(`memory.query\n${stableStringify(body)}`),
+                allowStaleOnUnavailable: true,
+            });
+            return asJsonValue({ resources: response.data });
+        });
+    }
+    async memoryHistory(input) {
+        return await this.execute(async () => {
+            const body = cleanJson({
+                sessionId: input.sessionId,
+                resourceKeys: input.resourceKeys,
+                paths: input.paths,
+                depth: input.depth,
+            });
+            const response = await this.dependencies.client.request(endpoints.memoryHistory, {
+                method: 'POST',
+                body,
+            });
+            const relatedBranches = await this.branchTaskReferences(input.repoRoot ?? process.cwd(), input.paths ?? []);
+            return asJsonValue({ history: response.data, relatedBranches });
+        });
+    }
+    async branchTaskReferences(repoRoot, paths) {
+        if (paths.length === 0)
+            return [];
+        const log = await this.dependencies.repositories.git.pathHistorySubjects(repoRoot, paths);
+        const seen = new Map();
+        for (const subject of log) {
+            for (const match of subject.matchAll(/[A-Z][A-Z0-9]+-\d+/g)) {
+                if (!seen.has(match[0]))
+                    seen.set(match[0], subject);
+            }
+        }
+        return [...seen.entries()].map(([taskReference, subject]) => ({
+            taskReference,
+            subject,
+        }));
+    }
+    async memoryProposeRevision(input) {
+        return await this.execute(async () => {
+            const { repoRoot, ...rawProposal } = input;
+            const proposal = normalizePersistentInput(rawProposal, repoRoot ?? process.cwd());
+            assertSafeToPersist(cleanJson(proposal));
+            const taskSnapshot = input.taskId
+                ? await this.activeTaskSnapshot(input.taskId, input.projectId, repoRoot)
+                : null;
+            const body = cleanJson({
+                ...proposal,
+                ...(taskSnapshot ? { expectedTaskVersion: taskSnapshot.taskVersion } : {}),
+            });
+            return await this.mutateWithOutbox('memory.propose_revision', endpoints.memoryProposeRevision, body);
+        });
+    }
+    async memoryListProposals(input) {
+        return await this.execute(async () => {
+            const response = await this.dependencies.client.request(endpoints.memoryListProposals, { method: 'POST', body: cleanJson(input) });
+            return asJsonValue({ proposals: response.data });
+        });
+    }
+    async memoryReviewProposal(input) {
+        return await this.execute(async () => {
+            const note = normalizePersistentInput(input.note, process.cwd());
+            assertSafeToPersist(cleanJson({ note }));
+            const response = await this.dependencies.client.request(endpoints.memoryReviewProposal(input.proposalId), {
+                method: 'POST',
+                body: cleanJson({
+                    projectId: input.projectId,
+                    decision: input.decision,
+                    note,
+                }),
+            });
+            const result = objectValue(response.data);
+            const invalidatedTaskIds = Array.isArray(result?.invalidatedTaskIds)
+                ? result.invalidatedTaskIds.filter((value) => typeof value === 'string')
+                : [];
+            for (const taskId of invalidatedTaskIds) {
+                await this.dependencies.gate.invalidateTask(taskId);
+            }
+            await this.dependencies.activeContexts.markTasksConflict(invalidatedTaskIds, 'approved_memory_revision_requires_refresh');
+            return asJsonValue({
+                ...objectOrEmpty(response.data),
+                contextRefreshRequired: invalidatedTaskIds.length > 0,
+            });
+        });
+    }
+    async taskCheckpoint(input) {
+        return await this.writeTaskEvent(input, false);
+    }
+    async taskRecordCorrection(input) {
+        const reference = input.correctionRef ?? input.summary;
+        const result = await this.writeTaskEvent({
+            ...input,
+            checkpointType: 'correction',
+            documents: {
+                ...input.documents,
+                decisions: [
+                    ...(input.documents?.decisions ?? []),
+                    correctionScopeLine(input.correctionScope ?? 'pending', reference),
+                ],
+            },
+        }, true);
+        if (!result.ok)
+            return result;
+        const pending = await this.pendingCorrectionScopes(input.projectId, input.taskSlug);
+        return {
+            ...result,
+            data: asJsonValue({
+                ...objectOrEmpty(result.data ?? null),
+                correctionScopePending: pending,
+                ...(pending.length > 0
+                    ? {
+                        nextAction: 'Ask the user in this reply where each listed correction belongs: only this task, permanent for this project, permanent for the organization, or a change to the product defaults that reaches every customer. Record the answer with task.record_correction using the same correctionRef. Verification stays blocked until every correction has a scope.',
+                    }
+                    : {}),
+            }),
+        };
+    }
+    async pendingCorrectionScopes(projectId, taskSlug) {
+        const journal = await this.dependencies.journal.load(projectId, taskSlug);
+        const pending = new Set();
+        for (const line of journal.projection?.decisions ?? []) {
+            const parsed = parseCorrectionScopeLine(line.summary);
+            if (!parsed)
+                continue;
+            if (parsed.scope === 'pending')
+                pending.add(parsed.reference);
+            else
+                pending.delete(parsed.reference);
+        }
+        return [...pending];
+    }
+    async taskSelfReview(input) {
+        return await this.execute(async () => {
+            const findings = normalizePersistentInput(input.findings, input.repoRoot ?? process.cwd());
+            assertSafeToPersist(cleanJson({ findings }));
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+            const snapshot = await this.activeTaskSnapshot(input.taskId, undefined, input.repoRoot);
+            const response = await this.dependencies.client.request(endpoints.taskSelfReview, {
+                method: 'POST',
+                body: cleanJson({
+                    taskId: input.taskId,
+                    expectedTaskVersion: snapshot.taskVersion,
+                    diffHash: repository.git.diffHash,
+                    reviewedResourceIds: input.reviewedResourceIds,
+                    findings,
+                }),
+            });
+            await this.captureTaskSnapshot(asJsonValue({ task: response.data }));
+            return asJsonValue({
+                selfReview: {
+                    diffHash: repository.git.diffHash,
+                    reviewedResourceIds: input.reviewedResourceIds,
+                    findings: findings.length,
+                },
+            });
+        });
+    }
+    async taskReconcile(input) {
+        return await this.execute(async () => {
+            const reason = normalizePersistentInput(input.reason, input.repoRoot ?? process.cwd());
+            assertSafeToPersist(cleanJson({
+                resourceId: input.resourceId,
+                type: input.type,
+                proposalId: input.proposalId,
+                revisionId: input.revisionId,
+                reason,
+            }));
+            const snapshot = await this.activeTaskSnapshot(input.taskId, undefined, input.repoRoot);
+            const response = await this.dependencies.client.request(endpoints.taskReconcile, {
+                method: 'POST',
+                body: cleanJson({
+                    taskId: input.taskId,
+                    resourceId: input.resourceId,
+                    type: input.type,
+                    proposalId: input.proposalId,
+                    revisionId: input.revisionId,
+                    reason,
+                    expectedTaskVersion: snapshot.taskVersion,
+                }),
+            });
+            await this.dependencies.gate.invalidateTask(input.taskId);
+            return asJsonValue({ reconciliation: response.data });
+        });
+    }
+    async taskResolvePendingDelivery(input) {
+        return await this.execute(async () => {
+            const entry = await this.dependencies.outbox.get(input.outboxId);
+            if (!entry) {
+                throw new Error('Pending delivery could not be found');
+            }
+            const metadata = {
+                id: entry.id,
+                operation: entry.operation,
+                attempts: entry.attempts,
+                lastError: entry.lastError,
+                createdAt: entry.createdAt,
+                journalBacked: Boolean(entry.journalRef),
+            };
+            if (input.action === 'inspect') {
+                return asJsonValue({ pendingDelivery: metadata });
+            }
+            if (!input.confirm) {
+                return asJsonValue({
+                    confirmationRequired: true,
+                    action: input.action,
+                    pendingDelivery: metadata,
+                });
+            }
+            const taskId = taskIdFromDeliverySafe(entry);
+            if (input.action === 'discard') {
+                if (entry.journalRef) {
+                    await this.dependencies.journal.discardDelivery(entry.journalRef.projectId, entry.journalRef.taskSlug, entry.journalRef.eventId);
+                }
+                await this.dependencies.outbox.acknowledge(entry.id);
+                if (taskId) {
+                    await this.dependencies.gate.invalidateTask(taskId);
+                }
+                return asJsonValue({ discarded: true, taskId, pendingDelivery: metadata });
+            }
+            if (!entry.lastError?.startsWith('api_409_')) {
+                throw new Error('Only a confirmed backend version conflict can be rebased');
+            }
+            if (entry.journalRef) {
+                const taskSnapshot = await this.refreshTaskPointer(taskId, entry.journalRef.projectId);
+                const rebased = await this.dependencies.journal.rebaseDelivery(entry.journalRef.projectId, entry.journalRef.taskSlug, entry.journalRef.eventId, taskSnapshot.taskVersion);
+                await this.dependencies.outbox.replaceBody(entry.id, rebased.body);
+                if (taskId) {
+                    await this.dependencies.gate.invalidateTask(taskId);
+                }
+                return asJsonValue({
+                    rebased: true,
+                    taskId,
+                    expectedTaskVersion: taskSnapshot.taskVersion,
+                    pendingDelivery: metadata,
+                });
+            }
+            if (entry.operation !== 'memory.propose_revision' || !taskId) {
+                throw new Error('This delivery cannot be safely rebased and must be discarded or retried');
+            }
+            if (!input.proposalRebaseApproved || input.confirmedBaseRevision === undefined) {
+                return asJsonValue({
+                    confirmationRequired: true,
+                    requiresNativeApproval: true,
+                    requiresFreshBaseRevision: true,
+                    pendingDelivery: metadata,
+                });
+            }
+            const proposal = objectValue(entry.body);
+            const projectId = typeof proposal?.projectId === 'string' ? proposal.projectId : null;
+            const queuedBaseRevision = proposal?.baseRevision;
+            if (!projectId || typeof queuedBaseRevision !== 'number') {
+                throw new Error('Queued proposal cannot establish its project revision contract');
+            }
+            if (queuedBaseRevision !== input.confirmedBaseRevision) {
+                return asJsonValue({
+                    rebased: false,
+                    resourceRevisionChanged: true,
+                    queuedBaseRevision,
+                    confirmedBaseRevision: input.confirmedBaseRevision,
+                    requiresNewProposal: true,
+                    pendingDelivery: metadata,
+                });
+            }
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd(), projectId);
+            const pointer = await this.requireActivePointer(repository.repoFingerprint, taskId);
+            const refreshed = await this.dependencies.client.request(endpoints.contextRefresh, {
+                method: 'POST',
+                body: { sessionId: pointer.sessionId },
+            });
+            const refreshData = objectValue(refreshed.data);
+            const refreshedTask = objectValue(refreshData?.task);
+            if (!refreshedTask || refreshedTask.id !== taskId) {
+                throw new Error('Context refresh did not return the queued proposal task');
+            }
+            const expectedTaskVersion = numericTaskVersion(refreshedTask.lockVersion);
+            const rebasedBody = cleanJson({ ...proposal, expectedTaskVersion });
+            await this.dependencies.outbox.replaceBody(entry.id, rebasedBody);
+            await this.captureTaskSnapshot(refreshed.data);
+            await this.dependencies.gate.invalidateTask(taskId);
+            return asJsonValue({
+                rebased: true,
+                taskId,
+                expectedTaskVersion,
+                confirmedBaseRevision: input.confirmedBaseRevision,
+                requiresPrepareChange: true,
+                pendingDelivery: metadata,
+            });
+        }, true);
+    }
+    async taskVerify(input) {
+        return await this.execute(async () => {
+            return await this.taskExclusive(input.taskId, async () => {
+                await this.recoverJournalOutbox();
+                const outbox = await this.flushOutbox();
+                const pendingOutboxCount = (await this.dependencies.outbox.list()).length;
+                const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+                if (pendingOutboxCount > 0) {
+                    return asJsonValue({
+                        verified: false,
+                        reason: 'pending_outbox',
+                        pendingOutboxCount,
+                        outbox,
+                        diffHash: repository.git.diffHash,
+                    });
+                }
+                const pointer = await this.requireActivePointer(repository.repoFingerprint, input.taskId, false, 'verify');
+                const pendingCorrectionScopes = await this.pendingCorrectionScopes(pointer.projectId, pointer.taskSlug);
+                if (pendingCorrectionScopes.length > 0) {
+                    return asJsonValue({
+                        verified: false,
+                        reason: 'pending_correction_scope',
+                        pendingCorrectionScopes,
+                        nextAction: 'Ask the user where each listed correction belongs — only this task, permanent for this project, permanent for the organization, or a change to the product defaults that reaches every customer — then record the answer with task.record_correction using the same correctionRef.',
+                        diffHash: repository.git.diffHash,
+                    });
+                }
+                let taskChangedPaths = [];
+                let taskChanges = [];
+                const snapshotResponse = await this.dependencies.client.request(endpoints.sessionResume, {
+                    method: 'POST',
+                    body: {
+                        sessionId: input.sessionId,
+                        repoFingerprint: repository.repoFingerprint,
+                        afterSequence: 0,
+                    },
+                });
+                const snapshot = objectValue(snapshotResponse.data);
+                const snapshotTask = objectValue(snapshot?.task);
+                const activeLease = objectValue(snapshot?.activeLease);
+                if (!snapshotTask || snapshotTask.id !== input.taskId) {
+                    throw new Error('Current backend task snapshot does not match verification');
+                }
+                const recoveredVerification = await this.retryVerificationRecovery(repository, pointer, snapshot);
+                if (recoveredVerification) {
+                    return asJsonValue({
+                        ...recoveredVerification,
+                        repository: publicRepository(repository),
+                    });
+                }
+                const taskMode = normalizeTaskMode(snapshotTask.mode);
+                const resourceDiscoveryPolicy = readResourceDiscoveryPolicy(snapshot, activeLease);
+                const validations = normalizePersistentInput(input.validations, repository.repoRoot);
+                if (taskMode === 'read_only') {
+                    if (input.leaseId || input.changedPaths?.length) {
+                        throw new Error('Read-only task verification does not accept a lease or changed paths');
+                    }
+                }
+                else {
+                    const baseline = pointer.changeBaseline;
+                    const leaseChangedPaths = Array.isArray(activeLease?.changedPaths)
+                        ? activeLease.changedPaths.filter((path) => typeof path === 'string')
+                        : [];
+                    if (!baseline || activeLease?.baselineDiffHash !== baseline.diffHash) {
+                        throw new Error('Write task verification requires its locally pinned change baseline');
+                    }
+                    taskChanges = manifestDelta(baseline.changedPaths, repository.git.changedPaths);
+                    taskChangedPaths = taskChanges.map((entry) => entry.path).sort();
+                    if (input.changedPaths &&
+                        stableStringify(normalizeChangedPaths(input.changedPaths)) !==
+                            stableStringify(taskChangedPaths)) {
+                        throw new Error('Reported changed paths do not match the actual Git manifest');
+                    }
+                    if (taskChangedPaths.length === 0 ||
+                        !activeLease ||
+                        !input.leaseId ||
+                        activeLease.id !== input.leaseId ||
+                        !pathsContainAll(baseline.leasePaths, taskChangedPaths) ||
+                        !pathsContainAll(leaseChangedPaths, taskChangedPaths)) {
+                        throw new Error('Write task verification requires the current backend change lease');
+                    }
+                    assertNewResourceEvidence(taskChanges.flatMap((entry) => newMemoryResourceCandidate(entry, resourceDiscoveryPolicy)), input.newResources ?? []);
+                }
+                assertSafeToPersist(cleanJson(validations));
+                assertValidationEvidence(validations);
+                const pathChangeManifest = taskMode === 'read_only'
+                    ? []
+                    : await buildPathChangeManifest(repository.repoRoot, taskChanges);
+                const verifyBody = cleanJson({
+                    taskId: input.taskId,
+                    sessionId: input.sessionId,
+                    expectedTaskVersion: numericTaskVersion(snapshotTask.lockVersion),
+                    ...(taskMode !== 'read_only'
+                        ? {
+                            leaseId: input.leaseId,
+                            baselineDiffHash: activeLease?.baselineDiffHash,
+                        }
+                        : {}),
+                    changedPaths: taskMode === 'read_only' ? [] : taskChangedPaths,
+                    pathChanges: pathChangeManifest,
+                    diffHash: repository.git.diffHash,
+                    validations,
+                    pendingOutboxCount,
+                    newResources: input.newResources,
+                });
+                await this.dependencies.activeContexts.setVerificationIntent(repository.repoFingerprint, {
+                    mode: taskMode,
+                    body: verifyBody,
+                    taskChanges,
+                });
+                let response;
+                try {
+                    response = await this.dependencies.client.request(endpoints.taskVerify, {
+                        method: 'POST',
+                        body: verifyBody,
+                    });
+                }
+                catch (error) {
+                    if (!isBackendUnavailableError(error)) {
+                        await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint);
+                    }
+                    throw error;
+                }
+                const responseData = objectValue(response.data);
+                if (responseData?.verified === true) {
+                    const taskVersion = numericTaskVersion(responseData.taskVersion);
+                    await this.dependencies.gate.record({
+                        taskId: input.taskId,
+                        projectId: repository.projectId,
+                        repoFingerprint: repository.repoFingerprint,
+                        repoRoot: repository.repoRoot,
+                        diffHash: repository.git.diffHash,
+                        taskVersion,
+                        taskChanges,
+                    });
+                    await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint);
+                }
+                else {
+                    await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint);
+                }
+                return asJsonValue({
+                    ...objectOrEmpty(response.data),
+                    mode: taskMode,
+                    repository: publicRepository(repository),
+                });
+            });
+        });
+    }
+    async taskClose(input) {
+        return await this.execute(async () => {
+            return await this.taskExclusive(input.taskId, async () => {
+                const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+                const pointer = await this.requireActivePointer(repository.repoFingerprint, input.taskId, false, 'close');
+                if (pointer.closeIntent) {
+                    return await this.retryCloseIntent(repository, pointer);
+                }
+                const snapshotResponse = await this.dependencies.client.request(endpoints.sessionResume, {
+                    method: 'POST',
+                    body: {
+                        sessionId: pointer.sessionId,
+                        repoFingerprint: repository.repoFingerprint,
+                        afterSequence: 0,
+                    },
+                });
+                const snapshot = objectValue(snapshotResponse.data);
+                const task = objectValue(snapshot?.task);
+                if (!task || task.id !== input.taskId) {
+                    throw new Error('Current backend task snapshot does not match task close');
+                }
+                const taskChanges = pointer.changeBaseline
+                    ? manifestDelta(pointer.changeBaseline.changedPaths, repository.git.changedPaths)
+                    : [];
+                const closeBody = {
+                    taskId: input.taskId,
+                    sessionId: pointer.sessionId,
+                    expectedTaskVersion: numericTaskVersion(task.lockVersion),
+                    diffHash: repository.git.diffHash,
+                };
+                await this.dependencies.activeContexts.setCloseIntent(repository.repoFingerprint, {
+                    body: closeBody,
+                    taskChanges,
+                });
+                return await this.deliverCloseIntent(repository, closeBody, taskChanges, false);
+            });
+        });
+    }
+    async projectSetup(input) {
+        return await this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+            const body = cleanJson({
+                organizationId: input.organizationId,
+                projectName: input.projectName,
+                projectSlug: input.projectSlug ?? slugify(input.projectName),
+                repoFingerprint: repository.repoFingerprint,
+                framework: input.framework,
+                figmaConfig: input.figmaConfig,
+                initialProjectProfile: input.initialProjectProfile,
+            });
+            if ('resourceDiscovery' in input.initialProjectProfile.metadata) {
+                throw new Error('Project setup metadata cannot override canonical resource discovery');
+            }
+            const persistentBody = normalizeRepositoryPaths(body, repository.repoRoot);
+            assertSafeToPersist(persistentBody);
+            const response = await this.dependencies.client.request(endpoints.projectSetup, {
+                method: 'POST',
+                body: persistentBody,
+            });
+            const data = objectValue(response.data);
+            const project = objectValue(data?.project);
+            const projectProfile = objectValue(data?.projectProfile);
+            const profileResource = objectValue(projectProfile?.resource);
+            const profileRevision = objectValue(projectProfile?.revision);
+            const policy = objectValue(data?.resourceDiscoveryPolicy);
+            const marker = objectValue(data?.marker);
+            if (!project ||
+                typeof project.id !== 'string' ||
+                !profileResource ||
+                !profileRevision ||
+                !policy ||
+                !marker ||
+                marker.projectId !== project.id ||
+                stringArray(policy.screenPathPatterns).length === 0 ||
+                stringArray(policy.componentPathPatterns).length === 0) {
+                throw new Error('Project setup response is not policy-ready');
+            }
+            const markerPath = await this.dependencies.repositories.writeMarker(repository.repoRoot, project.id);
+            return asJsonValue({ ...data, markerPath });
+        });
+    }
+    async projectMemberAdd(input) {
+        return await this.execute(async () => {
+            const response = await this.dependencies.client.request(endpoints.projectMemberAdd(input.projectId), {
+                method: 'POST',
+                body: { email: input.email, role: input.role },
+            });
+            return asJsonValue({ membership: response.data });
+        });
+    }
+    async organizationList() {
+        return await this.execute(async () => {
+            const authentication = await this.dependencies.browserAuth.ensureAuthenticated();
+            if (authentication) {
+                return asJsonValue({ authentication });
+            }
+            const response = await this.dependencies.client.request(endpoints.organizationList);
+            return asJsonValue({
+                selectionRequired: true,
+                questionnaire: 'Select the organization whose engineering core and architecture templates this project should inherit',
+                organizations: response.data,
+            });
+        });
+    }
+    async architecturePlan(input) {
+        return await this.execute(async () => {
+            const body = cleanJson(input);
+            const response = await this.dependencies.client.request(endpoints.memoryScaffoldPlan, {
+                method: 'POST',
+                body,
+                cacheKey: sha256(`architecture.plan\n${stableStringify(body)}`),
+                allowStaleOnUnavailable: true,
+            });
+            return asJsonValue({ modules: response.data });
+        });
+    }
+    async architectureModule(input) {
+        return await this.execute(async () => {
+            const body = cleanJson(input);
+            const response = await this.dependencies.client.request(endpoints.memoryArchitectureModule, {
+                method: 'POST',
+                body,
+                cacheKey: sha256(`architecture.module\n${stableStringify(body)}`),
+                allowStaleOnUnavailable: true,
+            });
+            return asJsonValue({ module: response.data });
+        });
+    }
+    async architectureRecordApplication(input) {
+        return await this.execute(async () => {
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd());
+            const snapshot = await this.activeTaskSnapshot(input.taskId, input.projectId, repository.repoRoot);
+            const files = await Promise.all(input.files.map(async (file) => {
+                const hash = await hashWorkingTreeFile(repository.repoRoot, file.path);
+                if (!hash) {
+                    throw new Error(`Applied template file is not readable: ${file.path}`);
+                }
+                return { templatePath: file.templatePath, path: file.path, sha256: hash };
+            }));
+            const body = cleanJson({
+                taskId: input.taskId,
+                projectId: input.projectId,
+                expectedTaskVersion: snapshot.taskVersion,
+                templateResourceId: input.templateResourceId,
+                templateRevisionId: input.templateRevisionId,
+                files,
+            });
+            assertSafeToPersist(body);
+            const response = await this.dependencies.client.request(endpoints.taskScaffoldApplication, { method: 'POST', body });
+            return asJsonValue({ application: response.data });
+        });
+    }
+    async organizationCreate(input) {
+        return await this.execute(async () => {
+            const response = await this.dependencies.client.request(endpoints.organizationCreate, { method: 'POST', body: cleanJson(input) });
+            return asJsonValue({ organization: response.data });
+        });
+    }
+    async projectList() {
+        return await this.execute(async () => {
+            const authentication = await this.dependencies.browserAuth.ensureAuthenticated();
+            if (authentication) {
+                return asJsonValue({ authentication });
+            }
+            const response = await this.dependencies.client.request(endpoints.projectList);
+            return asJsonValue({
+                selectionRequired: true,
+                questionnaire: 'Select an existing project or choose new project setup',
+                projects: response.data,
+            });
+        });
+    }
+    async projectResolve(input) {
+        return await this.execute(async () => {
+            const authentication = await this.dependencies.browserAuth.ensureAuthenticated();
+            if (authentication) {
+                return asJsonValue({ authentication });
+            }
+            const repository = await this.dependencies.repositories.resolve(input.repoRoot ?? process.cwd(), input.bind ? input.projectId : undefined);
+            if (input.bind) {
+                if (!input.projectId) {
+                    const projects = await this.dependencies.client.request(endpoints.projectList);
+                    return asJsonValue({
+                        resolved: false,
+                        selectionRequired: true,
+                        projects: projects.data,
+                        repository: publicRepository(repository),
+                    });
+                }
+                const response = await this.dependencies.client.request(endpoints.projectBind(input.projectId), {
+                    method: 'POST',
+                    body: { repoFingerprint: repository.repoFingerprint },
+                });
+                const project = objectValue(response.data);
+                if (!project || project.id !== input.projectId) {
+                    throw new Error('Project bind response does not match the selected project');
+                }
+                const markerPath = await this.dependencies.repositories.writeMarker(repository.repoRoot, input.projectId);
+                return asJsonValue({
+                    resolved: true,
+                    bound: true,
+                    project,
+                    markerPath,
+                    repository: publicRepository({
+                        ...repository,
+                        markerPath,
+                        projectId: input.projectId,
+                    }),
+                    selectionRequired: false,
+                });
+            }
+            const response = await this.dependencies.client.request(endpoints.projectResolve, {
+                method: 'POST',
+                body: { repoFingerprint: repository.repoFingerprint },
+            });
+            const project = objectValue(response.data);
+            return asJsonValue({
+                resolved: project !== null,
+                project,
+                markerPath: null,
+                repository: publicRepository(repository),
+                selectionRequired: project === null,
+            });
+        });
+    }
+    async authStatus() {
+        return await this.execute(async () => {
+            return asJsonValue(await this.dependencies.browserAuth.status());
+        });
+    }
+    async authSigninBrowser(input = {}) {
+        return await this.execute(async () => {
+            const authentication = await this.dependencies.browserAuth.ensureAuthenticated({
+                restart: input.restart ?? false,
+            });
+            return asJsonValue(authentication
+                ? { authentication }
+                : { authentication: { authenticated: true, pending: false } });
+        });
+    }
+    async authLogout(input = {}) {
+        return await this.execute(async () => {
+            const pendingOutboxCount = (await this.dependencies.outbox.list()).length;
+            if (pendingOutboxCount > 0) {
+                return asJsonValue({
+                    loggedOut: false,
+                    remoteRevoked: false,
+                    remoteStatus: 'pending_outbox',
+                    pendingOutboxCount,
+                    requiresPendingDeliveryResolution: true,
+                });
+            }
+            let remoteRevoked = false;
+            let remoteStatus = 'no_refresh_session';
+            let clearLocalSession = false;
+            try {
+                let refreshToken = await this.dependencies.credentials.get('refresh-token');
+                if (refreshToken) {
+                    try {
+                        await this.dependencies.client.request(endpoints.authLogout, {
+                            method: 'POST',
+                            body: { refreshToken },
+                            retryRefresh: false,
+                        });
+                    }
+                    catch (error) {
+                        if (!(error instanceof ApiResponseError) || error.httpStatus !== 401) {
+                            throw error;
+                        }
+                        await this.dependencies.client.refreshAuthentication();
+                        refreshToken = await this.dependencies.credentials.get('refresh-token');
+                        if (!refreshToken) {
+                            throw error;
+                        }
+                        await this.dependencies.client.request(endpoints.authLogout, {
+                            method: 'POST',
+                            body: { refreshToken },
+                            retryRefresh: false,
+                        });
+                    }
+                    remoteRevoked = true;
+                    remoteStatus = 'revoked';
+                    clearLocalSession = true;
+                }
+                else {
+                    clearLocalSession = true;
+                }
+            }
+            catch (error) {
+                remoteStatus = classifyError(error);
+                if (isDefinitiveAuthenticationFailure(error)) {
+                    remoteStatus = 'remote_session_invalid';
+                    clearLocalSession = true;
+                }
+                else if (input.confirmLocalOnly === true) {
+                    remoteStatus = 'local_only_confirmed';
+                    clearLocalSession = true;
+                }
+            }
+            if (!clearLocalSession) {
+                return asJsonValue({
+                    loggedOut: false,
+                    remoteRevoked: false,
+                    remoteStatus,
+                    retryRequired: true,
+                    localOnlyLogoutAvailable: true,
+                });
+            }
+            await this.dependencies.principalState?.clearAfterLogout();
+            if (!this.dependencies.principalState) {
+                await this.dependencies.credentials.clear();
+            }
+            await this.dependencies.browserAuth.dispose();
+            return asJsonValue({ loggedOut: true, remoteRevoked, remoteStatus });
+        }, true);
+    }
+    async writeTaskEvent(input, correction) {
+        const idempotencyKey = input.idempotencyKey ?? randomUUID();
+        const createdAt = new Date().toISOString();
+        return await this.execute(async () => {
+            const { repoRoot, ...persistedInput } = input;
+            const safeInput = normalizePersistentInput(persistedInput, repoRoot ?? process.cwd());
+            assertSafeToPersist(cleanJson(safeInput));
+            return await this.taskExclusive(input.taskId, async () => {
+                await this.recoverJournalOutbox(input.projectId, input.taskSlug);
+                await this.flushOutbox();
+                const journalInput = {
+                    eventId: idempotencyKey,
+                    taskId: input.taskId,
+                    projectId: input.projectId,
+                    taskSlug: input.taskSlug,
+                    checkpointType: safeInput.checkpointType,
+                    summary: safeInput.summary,
+                    ...(safeInput.details ? { details: safeInput.details } : {}),
+                    ...(safeInput.documents ? { documents: safeInput.documents } : {}),
+                    createdAt,
+                };
+                await this.dependencies.journal.assertEventContent(journalInput);
+                const journal = await this.dependencies.journal.load(input.projectId, input.taskSlug);
+                const pendingJournal = (await this.dependencies.journal.listPendingDeliveries(input.projectId, input.taskSlug)).find((delivery) => delivery.eventId === idempotencyKey);
+                if (journal.projection?.appliedEventIds.includes(idempotencyKey) && !pendingJournal) {
+                    return asJsonValue({
+                        local: { directory: journal.directory, applied: false },
+                        queued: false,
+                        replayed: true,
+                        idempotencyKey,
+                    });
+                }
+                const pointer = await this.resolveCheckpointPointer(input, repoRoot);
+                const taskEntries = (await this.dependencies.outbox.list()).filter((entry) => taskIdFromDeliverySafe(entry) === input.taskId);
+                const versionedTaskEntries = taskEntries.filter((entry) => entry.journalRef &&
+                    (entry.operation === 'task.checkpoint' || entry.operation === 'task.record_correction'));
+                const blockedEntry = taskEntries.find((entry) => entry.lastError && entry.lastError !== 'backend_unavailable');
+                if (blockedEntry && blockedEntry.idempotencyKey !== idempotencyKey) {
+                    throw new Error('A blocked task delivery must be explicitly resolved before checkpointing');
+                }
+                const existingExpected = pendingJournal
+                    ? expectedTaskVersionFromBody(pendingJournal.body)
+                    : null;
+                const expectedTaskVersion = existingExpected ??
+                    Math.max(pointer.taskVersion, ...versionedTaskEntries.map((entry) => (expectedTaskVersionFromBody(entry.body) ?? pointer.taskVersion - 1) + 1));
+                await this.dependencies.gate.invalidateTask(input.taskId);
+                const staged = await this.dependencies.journal.stage(journalInput, {
+                    operation: correction ? 'task.record_correction' : 'task.checkpoint',
+                    method: 'POST',
+                    path: correction ? endpoints.taskCorrection : endpoints.taskCheckpoint,
+                    expectedTaskVersion,
+                    correction,
+                });
+                if (!staged.delivery) {
+                    throw new Error('Task journal delivery was not materialized');
+                }
+                const queued = await this.dependencies.outbox.enqueue({
+                    operation: staged.delivery.operation,
+                    method: staged.delivery.method,
+                    path: staged.delivery.path,
+                    body: staged.delivery.body,
+                    idempotencyKey,
+                    journalRef: {
+                        projectId: input.projectId,
+                        taskSlug: input.taskSlug,
+                        eventId: idempotencyKey,
+                    },
+                });
+                if (staged.applied) {
+                    await this.dependencies.activeContexts.updateTaskSnapshot(input.taskId, expectedTaskVersion + 1, pointer.lastSequence + 1);
+                }
+                const predecessorEntries = taskEntries.filter((entry) => entry.id !== queued.id);
+                if (predecessorEntries.length > 0) {
+                    return asJsonValue({
+                        local: { directory: staged.directory, applied: staged.applied },
+                        queued: true,
+                        outboxId: queued.id,
+                        idempotencyKey,
+                        expectedTaskVersion,
+                        predictedTaskVersion: expectedTaskVersion + 1,
+                        deliveryStatus: 'pending',
+                        waitingForOrderedDeliveries: predecessorEntries.map((entry) => entry.id),
+                    });
+                }
+                try {
+                    const response = await this.dependencies.client.request(staged.delivery.path, {
+                        method: staged.delivery.method,
+                        idempotencyKey,
+                        body: staged.delivery.body,
+                    });
+                    await this.captureTaskSnapshot(response.data);
+                    await this.dependencies.journal.markDeliverySynchronized(input.projectId, input.taskSlug, idempotencyKey);
+                    const synchronizedPointer = await this.dependencies.activeContexts.findByTaskId(input.taskId, input.projectId);
+                    await this.seedResumeSnapshot(synchronizedPointer, objectValue(response.data) ?? undefined);
+                    await this.dependencies.outbox.acknowledge(queued.id);
+                    return asJsonValue({
+                        backend: response.data,
+                        local: { directory: staged.directory, applied: staged.applied },
+                        queued: false,
+                        idempotencyKey,
+                        expectedTaskVersion,
+                    });
+                }
+                catch (error) {
+                    const errorKind = classifyError(error);
+                    await this.dependencies.outbox.markAttempt(queued.id, errorKind);
+                    await this.dependencies.journal.markDeliveryAttempt(input.projectId, input.taskSlug, idempotencyKey, errorKind);
+                    return asJsonValue({
+                        local: { directory: staged.directory, applied: staged.applied },
+                        queued: true,
+                        outboxId: queued.id,
+                        idempotencyKey,
+                        expectedTaskVersion,
+                        predictedTaskVersion: expectedTaskVersion + 1,
+                        deliveryStatus: isBackendUnavailableError(error) ? 'pending' : 'blocked',
+                        backendError: publicError(error),
+                    });
+                }
+            });
+        });
+    }
+    async mutateWithOutbox(operation, path, body) {
+        assertSafeToPersist(body);
+        const idempotencyKey = randomUUID();
+        try {
+            const response = await this.dependencies.client.request(path, {
+                method: 'POST',
+                body,
+                idempotencyKey,
+            });
+            return asJsonValue({ data: response.data, queued: false, idempotencyKey });
+        }
+        catch (error) {
+            if (!isBackendUnavailableError(error)) {
+                throw error;
+            }
+            const queued = await this.dependencies.outbox.enqueue({
+                operation,
+                method: 'POST',
+                path,
+                body,
+                idempotencyKey,
+            });
+            return asJsonValue({ queued: true, outboxId: queued.id, idempotencyKey });
+        }
+    }
+    async flushOutbox() {
+        const entries = await this.dependencies.outbox.list();
+        const synchronized = [];
+        const blocked = [];
+        for (const entry of entries) {
+            try {
+                const response = await this.dependencies.client.request(entry.path, {
+                    method: entry.method,
+                    body: entry.body,
+                    idempotencyKey: entry.idempotencyKey,
+                });
+                await this.captureTaskSnapshot(response.data);
+                if (entry.journalRef) {
+                    await this.dependencies.journal.markDeliverySynchronized(entry.journalRef.projectId, entry.journalRef.taskSlug, entry.journalRef.eventId);
+                    const deliveryTaskId = taskIdFromDeliverySafe(entry);
+                    if (deliveryTaskId) {
+                        const synchronizedPointer = await this.dependencies.activeContexts.findByTaskId(deliveryTaskId, entry.journalRef.projectId, false);
+                        await this.seedResumeSnapshot(synchronizedPointer, objectValue(response.data) ?? undefined);
+                    }
+                }
+                await this.dependencies.outbox.acknowledge(entry.id);
+                synchronized.push(entry.id);
+            }
+            catch (error) {
+                const errorKind = classifyError(error);
+                await this.dependencies.outbox.markAttempt(entry.id, errorKind);
+                if (entry.journalRef) {
+                    await this.dependencies.journal.markDeliveryAttempt(entry.journalRef.projectId, entry.journalRef.taskSlug, entry.journalRef.eventId, errorKind);
+                }
+                blocked.push({ id: entry.id, error: errorKind });
+                break;
+            }
+        }
+        return asJsonValue({
+            synchronized,
+            blocked,
+            pending: (await this.dependencies.outbox.list()).length,
+        });
+    }
+    async recoverJournalOutbox(projectId, taskSlug) {
+        const pending = await this.dependencies.journal.listPendingDeliveries(projectId, taskSlug);
+        for (const delivery of pending) {
+            await this.dependencies.outbox.enqueue({
+                operation: delivery.operation,
+                method: delivery.method,
+                path: delivery.path,
+                body: delivery.body,
+                idempotencyKey: delivery.idempotencyKey,
+                journalRef: {
+                    projectId: delivery.projectId,
+                    taskSlug: delivery.taskSlug,
+                    eventId: delivery.eventId,
+                },
+            });
+        }
+        return pending.length;
+    }
+    async activeTaskSnapshot(taskId, projectId, repoRoot) {
+        const repository = await this.dependencies.repositories.resolve(repoRoot ?? process.cwd(), projectId);
+        const pointer = await this.requireActivePointer(repository.repoFingerprint, taskId);
+        if ((projectId && pointer.projectId !== projectId) ||
+            (repository.projectId && pointer.projectId !== repository.projectId)) {
+            throw new Error('Active task snapshot does not match the repository project');
+        }
+        if ((await this.dependencies.outbox.list()).some((entry) => taskIdFromDeliverySafe(entry) === taskId)) {
+            throw new Error('Pending task deliveries must be resolved before using the task snapshot');
+        }
+        const response = await this.dependencies.client.request(endpoints.sessionResume, {
+            method: 'POST',
+            body: {
+                sessionId: pointer.sessionId,
+                repoFingerprint: repository.repoFingerprint,
+                afterSequence: 0,
+            },
+        });
+        const backend = objectValue(response.data);
+        const task = objectValue(backend?.task);
+        if (!task || task.id !== taskId || backend?.requiresContextRefresh === true) {
+            throw new Error('Backend task snapshot is stale or does not match the active task');
+        }
+        const refreshed = {
+            ...pointer,
+            taskVersion: numericTaskVersion(task.lockVersion),
+            lastSequence: numericSequence(task.lastSequence),
+        };
+        await this.dependencies.activeContexts.save(refreshed);
+        return refreshed;
+    }
+    async refreshTaskPointer(taskId, projectId) {
+        const pointer = await this.dependencies.activeContexts.findByTaskId(taskId, projectId);
+        const response = await this.dependencies.client.request(endpoints.sessionResume, {
+            method: 'POST',
+            body: {
+                sessionId: pointer.sessionId,
+                repoFingerprint: pointer.repoFingerprint,
+                afterSequence: 0,
+            },
+        });
+        const backend = objectValue(response.data);
+        const task = objectValue(backend?.task);
+        if (!task || task.id !== taskId || backend?.requiresContextRefresh === true) {
+            throw new Error('Backend task snapshot is stale or does not match the pending delivery');
+        }
+        const refreshed = {
+            ...pointer,
+            taskVersion: numericTaskVersion(task.lockVersion),
+            lastSequence: numericSequence(task.lastSequence),
+        };
+        await this.dependencies.activeContexts.save(refreshed);
+        return refreshed;
+    }
+    async requireActivePointer(repoFingerprint, taskId, allowOfflineWarnings = false, allowedIntent) {
+        const pointer = await this.dependencies.activeContexts.load(repoFingerprint);
+        const blockingConflicts = pointer?.resumeConflicts.filter((conflict) => !(allowOfflineWarnings && isOfflineDevelopmentWarning(conflict)));
+        const lifecycleIntentBlocked = (pointer?.verificationIntent && allowedIntent !== 'verify') ||
+            (pointer?.closeIntent && allowedIntent !== 'close');
+        if (!pointer ||
+            pointer.taskId !== taskId ||
+            (blockingConflicts?.length ?? 0) > 0 ||
+            lifecycleIntentBlocked) {
+            throw new Error('A clean active task snapshot is required for this operation');
+        }
+        return pointer;
+    }
+    async captureTaskSnapshot(value) {
+        const data = objectValue(value ?? undefined);
+        const task = objectValue(data?.task);
+        if (task && typeof task.id === 'string' && typeof task.lockVersion === 'number') {
+            await this.dependencies.activeContexts.updateTaskSnapshot(task.id, numericTaskVersion(task.lockVersion), numericSequence(task.lastSequence));
+        }
+    }
+    async retryVerificationRecovery(repository, pointer, backend) {
+        const intent = pointer.verificationIntent;
+        const recovery = objectValue(backend?.verificationRecovery);
+        if (!intent) {
+            return null;
+        }
+        const body = intent.body;
+        const backendTask = objectValue(backend?.task);
+        const backendSession = objectValue(backend?.session);
+        const expectedTaskVersion = numericTaskVersion(body.expectedTaskVersion);
+        if (repository.projectId !== pointer.projectId ||
+            repository.git.diffHash !== body.diffHash ||
+            pointer.taskId !== body.taskId ||
+            pointer.sessionId !== body.sessionId ||
+            backendTask?.id !== pointer.taskId ||
+            backendTask.projectId !== pointer.projectId ||
+            backendSession?.id !== pointer.sessionId ||
+            body.pendingOutboxCount !== 0) {
+            throw new Error('Verification recovery does not match the durable verification intent');
+        }
+        if (recovery) {
+            const recoveryTaskVersion = numericTaskVersion(recovery.taskVersion);
+            if (recovery.diffHash !== body.diffHash ||
+                recovery.mode !== intent.mode ||
+                (recoveryTaskVersion !== expectedTaskVersion &&
+                    recoveryTaskVersion !== expectedTaskVersion + 1)) {
+                throw new Error('Verification recovery does not match the verified backend task');
+            }
+        }
+        else if (numericTaskVersion(backendTask.lockVersion) !== expectedTaskVersion ||
+            normalizeTaskMode(backendTask.mode) !== intent.mode) {
+            throw new Error('Open backend task does not match the durable verification intent');
+        }
+        const currentTaskChanges = intent.mode !== 'read_only'
+            ? pointer.changeBaseline
+                ? manifestDelta(pointer.changeBaseline.changedPaths, repository.git.changedPaths)
+                : null
+            : [];
+        if (!currentTaskChanges) {
+            throw new Error('Verification recovery is missing its locally pinned baseline');
+        }
+        const currentChangedPaths = currentTaskChanges.map((entry) => entry.path).sort();
+        const currentPathChanges = intent.mode === 'read_only'
+            ? []
+            : await buildPathChangeManifest(repository.repoRoot, currentTaskChanges);
+        if (stableStringify(body.changedPaths ?? null) !== stableStringify(currentChangedPaths) ||
+            stableStringify(body.pathChanges ?? null) !== stableStringify(currentPathChanges) ||
+            stableStringify(intent.taskChanges.map(changedPathIdentity)) !==
+                stableStringify(currentTaskChanges.map(changedPathIdentity))) {
+            throw new Error('Current Git state does not match the durable verification intent');
+        }
+        if (intent.mode !== 'read_only') {
+            const retryLease = recovery
+                ? objectValue(recovery.consumedLease)
+                : objectValue(backend?.activeLease);
+            const retryLeasePaths = Array.isArray(retryLease?.changedPaths)
+                ? retryLease.changedPaths.filter((path) => typeof path === 'string')
+                : [];
+            if (!retryLease ||
+                retryLease.id !== body.leaseId ||
+                retryLease.taskId !== pointer.taskId ||
+                retryLease.sessionId !== pointer.sessionId ||
+                retryLease.baselineDiffHash !== body.baselineDiffHash ||
+                body.baselineDiffHash !== pointer.changeBaseline?.diffHash ||
+                !pathsContainAll(retryLeasePaths, currentChangedPaths)) {
+                throw new Error('Backend lease does not match the durable verification intent');
+            }
+        }
+        else if (currentChangedPaths.length !== 0 ||
+            body.leaseId !== undefined ||
+            body.baselineDiffHash !== undefined) {
+            throw new Error('Read-only verification recovery contains a write lease');
+        }
+        let response;
+        try {
+            response = await this.dependencies.client.request(endpoints.taskVerify, {
+                method: 'POST',
+                body,
+            });
+        }
+        catch (error) {
+            if (!isBackendUnavailableError(error)) {
+                await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint);
+            }
+            throw error;
+        }
+        const responseData = objectValue(response.data);
+        if (responseData?.verified !== true || responseData.diffHash !== body.diffHash) {
+            await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint);
+            throw new Error('Verification retry did not confirm the durable verification intent');
+        }
+        const taskVersion = numericTaskVersion(responseData.taskVersion);
+        await this.dependencies.gate.record({
+            taskId: pointer.taskId,
+            projectId: pointer.projectId,
+            repoFingerprint: pointer.repoFingerprint,
+            repoRoot: repository.repoRoot,
+            diffHash: repository.git.diffHash,
+            taskVersion,
+            taskChanges: intent.taskChanges,
+        });
+        await this.dependencies.activeContexts.clearVerificationIntent(repository.repoFingerprint);
+        await this.dependencies.activeContexts.updateTaskSnapshot(pointer.taskId, taskVersion, pointer.lastSequence);
+        return { ...responseData, recoveredAfterResponseLoss: true };
+    }
+    async retryCloseIntent(repository, pointer) {
+        const intent = pointer.closeIntent;
+        if (!intent) {
+            throw new Error('Durable close intent is unavailable');
+        }
+        const body = intent.body;
+        const currentTaskChanges = pointer.changeBaseline
+            ? manifestDelta(pointer.changeBaseline.changedPaths, repository.git.changedPaths)
+            : [];
+        if (repository.projectId !== pointer.projectId ||
+            repository.git.diffHash !== body.diffHash ||
+            pointer.taskId !== body.taskId ||
+            pointer.sessionId !== body.sessionId ||
+            stableStringify(intent.taskChanges.map(changedPathIdentity)) !==
+                stableStringify(currentTaskChanges.map(changedPathIdentity))) {
+            throw new Error('Current state does not match the durable close intent');
+        }
+        return await this.deliverCloseIntent(repository, body, intent.taskChanges, true);
+    }
+    async deliverCloseIntent(repository, body, taskChanges, recoveredAfterResponseLoss) {
+        let response;
+        try {
+            response = await this.dependencies.client.request(endpoints.taskClose, {
+                method: 'POST',
+                body,
+            });
+        }
+        catch (error) {
+            if (!isBackendUnavailableError(error)) {
+                await this.dependencies.activeContexts.clearCloseIntent(repository.repoFingerprint);
+            }
+            throw error;
+        }
+        const closedTask = objectValue(response.data);
+        if (closedTask?.closed !== true) {
+            await this.dependencies.activeContexts.clearCloseIntent(repository.repoFingerprint);
+            throw new Error('Task close response does not confirm task closure');
+        }
+        const closedTaskVersion = numericTaskVersion(closedTask.taskVersion);
+        await this.dependencies.gate.record({
+            taskId: String(body.taskId),
+            projectId: repository.projectId,
+            repoFingerprint: repository.repoFingerprint,
+            repoRoot: repository.repoRoot,
+            diffHash: String(body.diffHash),
+            taskClosed: true,
+            taskVersion: closedTaskVersion,
+            taskChanges,
+        });
+        await this.dependencies.activeContexts.clearCloseIntent(repository.repoFingerprint);
+        return asJsonValue({
+            ...closedTask,
+            repository: publicRepository(repository),
+            recoveredAfterResponseLoss,
+            delivery: deliveryQuestion(),
+        });
+    }
+    async seedResumeSnapshot(pointer, backendPatch) {
+        const cacheKey = resumeCacheKey(pointer.sessionId, pointer.repoFingerprint, 0);
+        const cached = await this.dependencies.client.readCached(cacheKey);
+        const cachedData = objectValue(cached?.data ?? undefined);
+        const base = { ...objectOrEmpty(cachedData), ...objectOrEmpty(backendPatch ?? null) };
+        const baseTask = objectValue(base.task);
+        const patchTask = objectValue(backendPatch?.task);
+        const baseSession = objectValue(base.session);
+        const patchSession = objectValue(backendPatch?.session);
+        const journal = await this.dependencies.journal.load(pointer.projectId, pointer.taskSlug);
+        if (!journal.projection) {
+            return;
+        }
+        const local = await this.dependencies.journal.canonicalResumeState(pointer.projectId, pointer.taskSlug);
+        const data = asJsonValue({
+            ...base,
+            task: {
+                ...objectOrEmpty(baseTask),
+                ...objectOrEmpty(patchTask),
+                id: pointer.taskId,
+                projectId: pointer.projectId,
+                lockVersion: pointer.taskVersion,
+                lastSequence: pointer.lastSequence,
+            },
+            session: {
+                ...objectOrEmpty(baseSession),
+                ...objectOrEmpty(patchSession),
+                id: pointer.sessionId,
+            },
+            events: local.events,
+            documents: local.documents,
+            requiresContextRefresh: false,
+        });
+        await this.dependencies.client.seedCache(cacheKey, {
+            data,
+            message: null,
+            status: 'success',
+            errorModel: null,
+        });
+    }
+    async resolveCheckpointPointer(input, repoRoot) {
+        const pointer = repoRoot
+            ? await (async () => {
+                const repository = await this.dependencies.repositories.resolve(repoRoot, input.projectId);
+                return await this.requireActivePointer(repository.repoFingerprint, input.taskId, true);
+            })()
+            : await this.dependencies.activeContexts.findByTaskId(input.taskId, input.projectId, false);
+        if (pointer.resumeConflicts.some((conflict) => !isOfflineDevelopmentWarning(conflict))) {
+            throw new Error('A clean active task snapshot is required for checkpointing');
+        }
+        if (pointer.verificationIntent || pointer.closeIntent) {
+            throw new Error('A clean active task snapshot is required for checkpointing');
+        }
+        if (pointer.taskSlug !== input.taskSlug) {
+            throw new Error('Checkpoint task slug does not match the active task pointer');
+        }
+        return pointer;
+    }
+    async taskExclusive(taskId, action) {
+        const previous = this.taskQueues.get(taskId) ?? Promise.resolve();
+        let release = () => undefined;
+        const current = new Promise((resolvePromise) => {
+            release = resolvePromise;
+        });
+        const tail = previous.then(() => current);
+        this.taskQueues.set(taskId, tail);
+        await previous;
+        try {
+            return await action();
+        }
+        finally {
+            release();
+            if (this.taskQueues.get(taskId) === tail) {
+                this.taskQueues.delete(taskId);
+            }
+        }
+    }
+    async execute(action, skipPrincipalCheck = false) {
+        try {
+            if (!skipPrincipalCheck) {
+                await this.dependencies.principalState?.ensure();
+            }
+            return { ok: true, data: await action() };
+        }
+        catch (error) {
+            if (isBackendUnavailableError(error)) {
+                return {
+                    ok: false,
+                    error: {
+                        kind: 'backend_unavailable',
+                        message: error instanceof Error ? error.message : 'Backend is unavailable',
+                        retryable: true,
+                    },
+                };
+            }
+            if (error instanceof ApiResponseError) {
+                return {
+                    ok: false,
+                    error: {
+                        kind: 'api_response',
+                        message: error.message,
+                        code: error.code ?? error.httpStatus,
+                        retryable: error.retryable,
+                    },
+                };
+            }
+            return {
+                ok: false,
+                error: {
+                    kind: 'bridge_error',
+                    message: error instanceof Error ? error.message : 'Bridge operation failed',
+                    retryable: false,
+                },
+            };
+        }
+    }
+}
+function normalizeChangedPaths(paths) {
+    const normalized = paths.map((path) => path.replace(/\\/g, '/').replace(/^\.\//, ''));
+    for (const path of normalized) {
+        if (!path ||
+            path.startsWith('/') ||
+            /^[A-Za-z]:\//.test(path) ||
+            path.split('/').includes('..')) {
+            throw new Error(`Changed path must be repository-relative: ${path}`);
+        }
+    }
+    return [...new Set(normalized)].sort();
+}
+function pathsContainAll(allowedPaths, actualPaths) {
+    const allowed = new Set(normalizeChangedPaths(allowedPaths));
+    return normalizeChangedPaths(actualPaths).every((path) => allowed.has(path));
+}
+function manifestDelta(baseline, current) {
+    const baselineByPath = new Map(baseline.map((entry) => [entry.path, entry]));
+    const currentByPath = new Map(current.map((entry) => [entry.path, entry]));
+    const renamedOriginalPaths = new Set(current.flatMap((entry) => (entry.originalPath ? [entry.originalPath] : [])));
+    const delta = current.filter((entry) => {
+        const previous = baselineByPath.get(entry.path);
+        return (!previous ||
+            stableStringify(changedPathIdentity(previous)) !== stableStringify(changedPathIdentity(entry)));
+    });
+    for (const entry of baseline) {
+        if (!currentByPath.has(entry.path) && !renamedOriginalPaths.has(entry.path)) {
+            delta.push({
+                path: entry.path,
+                status: 'D ',
+                contentHash: null,
+                size: null,
+                mode: null,
+            });
+        }
+    }
+    return delta.sort((left, right) => left.path.localeCompare(right.path));
+}
+function changedPathIdentity(entry) {
+    return {
+        path: entry.path,
+        originalPath: entry.originalPath ?? null,
+        status: semanticGitStatus(entry.status),
+        contentHash: entry.contentHash,
+        size: entry.size,
+        mode: entry.mode ?? null,
+    };
+}
+function semanticGitStatus(status) {
+    if (status === '??') {
+        return 'A';
+    }
+    for (const candidate of ['R', 'C', 'A', 'D', 'T', 'U', 'M']) {
+        if (status.includes(candidate)) {
+            return candidate;
+        }
+    }
+    return status.trim() || status;
+}
+function semanticPathStatus(status) {
+    const semantic = semanticGitStatus(status);
+    if (!['A', 'R', 'C', 'M', 'D', 'T', 'U'].includes(semantic)) {
+        throw new Error(`Unsupported semantic Git status: ${status}`);
+    }
+    return semantic;
+}
+function normalizeTaskMode(mode) {
+    if (mode === 'read_only')
+        return 'read_only';
+    if (mode === 'scaffold')
+        return 'scaffold';
+    return 'write';
+}
+async function hashWorkingTreeFile(repoRoot, path) {
+    try {
+        return sha256(await readFile(join(repoRoot, path)));
+    }
+    catch {
+        return undefined;
+    }
+}
+async function buildPathChangeManifest(repoRoot, changes) {
+    return await Promise.all(changes.map(async (entry) => {
+        const hash = entry.status === 'D' ? undefined : await hashWorkingTreeFile(repoRoot, entry.path);
+        return cleanJson({
+            path: entry.path,
+            status: semanticPathStatus(entry.status),
+            ...(entry.originalPath ? { originalPath: entry.originalPath } : {}),
+            ...(hash ? { sha256: hash } : {}),
+        });
+    }));
+}
+function publicRepository(repository) {
+    return asJsonValue({
+        repoRoot: repository.repoRoot,
+        markerPath: repository.markerPath,
+        projectId: repository.projectId,
+        schemaVersion: repository.schemaVersion,
+        repoFingerprint: repository.repoFingerprint,
+        git: {
+            repoRoot: repository.git.repoRoot,
+            head: repository.git.head,
+            diffHash: repository.git.diffHash,
+            changedPaths: repository.git.changedPaths.map(({ path, status, originalPath }) => ({
+                path,
+                status,
+                ...(originalPath ? { originalPath } : {}),
+            })),
+        },
+    });
+}
+export function correctionScopeLine(scope, reference) {
+    return `Correction scope ${scope}: ${reference}`;
+}
+export function parseCorrectionScopeLine(summary) {
+    const match = /^Correction scope ([a-z_]+): (.+)$/.exec(summary);
+    return match ? { scope: match[1], reference: match[2] } : null;
+}
+function deliveryQuestion() {
+    return asJsonValue({
+        required: true,
+        question: 'The task is closed and nothing has been committed. Ask the user which of these to do, and do only what they choose.',
+        options: [
+            { id: 'commit', label: 'Commit' },
+            { id: 'commit_push', label: 'Commit and push' },
+            {
+                id: 'commit_push_draft_pr',
+                label: 'Commit, push and open a draft pull request',
+                input: 'base branch the pull request targets',
+            },
+            {
+                id: 'commit_push_pr',
+                label: 'Commit, push and open a pull request',
+                input: 'base branch the pull request targets',
+            },
+        ],
+        afterPullRequest: 'Do not end the turn once a pull request exists. Check whether it merges cleanly, report the conflicting files if it does not, and ask whether to resolve them before touching anything.',
+    });
+}
+function cleanJson(value) {
+    return JSON.parse(JSON.stringify(value));
+}
+function normalizePersistentInput(value, repoRoot) {
+    if (value === undefined) {
+        return value;
+    }
+    return normalizeRepositoryPaths(cleanJson(value), repoRoot);
+}
+function asJsonValue(value) {
+    return cleanJson(value);
+}
+function objectValue(value) {
+    return value !== null && value !== undefined && !Array.isArray(value) && typeof value === 'object'
+        ? value
+        : null;
+}
+function objectOrEmpty(value) {
+    return objectValue(value ?? undefined) ?? {};
+}
+function slugify(value) {
+    return value
+        .trim()
+        .toLowerCase()
+        .normalize('NFKD')
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-|-$/g, '');
+}
+function deterministicUuid(...parts) {
+    const value = sha256(parts.join('\n')).slice(0, 32).split('');
+    value[12] = '5';
+    value[16] = ((Number.parseInt(value[16], 16) & 0x3) | 0x8).toString(16);
+    const hex = value.join('');
+    return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function resumeCacheKey(sessionId, repoFingerprint, afterSequence) {
+    return sha256(`session.resume\n${sessionId}\n${repoFingerprint}\n${afterSequence}`);
+}
+function classifyError(error) {
+    if (isBackendUnavailableError(error)) {
+        return 'backend_unavailable';
+    }
+    if (error instanceof ApiResponseError) {
+        return `api_${error.httpStatus}_${error.code ?? 'unknown'}`;
+    }
+    return 'bridge_delivery_error';
+}
+function isDefinitiveAuthenticationFailure(error) {
+    return (error instanceof ApiResponseError &&
+        (error.httpStatus === 400 || error.httpStatus === 401 || error.httpStatus === 403));
+}
+function publicError(error) {
+    if (isBackendUnavailableError(error)) {
+        return asJsonValue({
+            kind: 'backend_unavailable',
+            retryable: true,
+            ...(error instanceof ApiResponseError ? { httpStatus: error.httpStatus } : {}),
+        });
+    }
+    if (error instanceof ApiResponseError) {
+        return asJsonValue({
+            kind: 'api_response',
+            httpStatus: error.httpStatus,
+            code: error.code,
+            retryable: error.retryable,
+        });
+    }
+    return asJsonValue({
+        kind: 'bridge_error',
+        retryable: false,
+    });
+}
+function isBackendUnavailableError(error) {
+    return (error instanceof BackendUnavailableError ||
+        (error instanceof ApiResponseError && [502, 503, 504].includes(error.httpStatus)));
+}
+function numericSequence(value) {
+    const sequence = typeof value === 'number' ? value : Number(value ?? 0);
+    if (!Number.isSafeInteger(sequence) || sequence < 0) {
+        throw new Error('Backend task sequence is invalid');
+    }
+    return sequence;
+}
+function isIsoTimestamp(value) {
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+}
+function numericTaskVersion(value) {
+    const version = typeof value === 'number' ? value : Number(value);
+    if (!Number.isSafeInteger(version) || version < 1) {
+        throw new Error('Backend task version is invalid');
+    }
+    return version;
+}
+function validateOfflineLease(value, sessionId, changedPaths, baselineDiffHash) {
+    const data = objectValue(value ?? undefined);
+    const lease = objectValue(data?.lease);
+    const leasePaths = Array.isArray(lease?.changedPaths)
+        ? lease.changedPaths.filter((path) => typeof path === 'string')
+        : [];
+    const expiresAt = typeof lease?.expiresAt === 'string' ? Date.parse(lease.expiresAt) : NaN;
+    if (!lease ||
+        typeof lease.id !== 'string' ||
+        lease.sessionId !== sessionId ||
+        lease.baselineDiffHash !== baselineDiffHash ||
+        stableStringify(normalizeChangedPaths(leasePaths)) !== stableStringify(changedPaths) ||
+        !Number.isFinite(expiresAt) ||
+        expiresAt <= Date.now()) {
+        throw new Error('Cached change lease is missing, expired or does not match the current Git state');
+    }
+}
+function isOfflineLeaseUsable(lease, sessionId, changedPaths, baselineDiffHash) {
+    if (!lease || !baselineDiffHash) {
+        return false;
+    }
+    try {
+        validateOfflineLease({ lease }, sessionId, normalizeChangedPaths(changedPaths), baselineDiffHash);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function isOfflineDevelopmentWarning(value) {
+    return (value === 'backend_resume_is_stale' ||
+        value === 'pending_outbox_delivery' ||
+        value === 'pending_local_journal_delivery' ||
+        value === 'backend_local_sequence_mismatch' ||
+        value.startsWith('backend_local_document_mismatch:'));
+}
+function taskIdFromDelivery(value) {
+    const body = objectValue(value);
+    if (!body || typeof body.taskId !== 'string') {
+        throw new Error('Pending task delivery does not contain a task identifier');
+    }
+    return body.taskId;
+}
+function expectedTaskVersionFromBody(value) {
+    const body = objectValue(value);
+    return body && typeof body.expectedTaskVersion === 'number'
+        ? numericTaskVersion(body.expectedTaskVersion)
+        : null;
+}
+function taskIdFromDeliverySafe(entry) {
+    try {
+        return taskIdFromDelivery(entry.body);
+    }
+    catch {
+        return null;
+    }
+}
+function resumeConflicts(backend, backendTask, pointer, localJournal, localDocuments, pendingOutbox, responseSource) {
+    const conflicts = [];
+    const backendTaskId = typeof backendTask.id === 'string' ? backendTask.id : null;
+    if (pointer && backendTaskId !== pointer.taskId) {
+        conflicts.push('active_task_identity_mismatch');
+    }
+    if (responseSource === 'stale_cache') {
+        conflicts.push('backend_resume_is_stale');
+    }
+    if (pendingOutbox.length > 0) {
+        conflicts.push('pending_outbox_delivery');
+    }
+    if (localJournal.pendingDeliveryCount > 0) {
+        conflicts.push('pending_local_journal_delivery');
+    }
+    const localEventCount = localJournal.projection?.appliedEventIds.length ?? 0;
+    if (numericSequence(backendTask.lastSequence) !== localEventCount) {
+        conflicts.push('backend_local_sequence_mismatch');
+    }
+    const backendDocuments = Array.isArray(backend.documents) ? backend.documents : [];
+    for (const value of backendDocuments) {
+        const document = objectValue(value);
+        if (!document ||
+            typeof document.documentType !== 'string' ||
+            typeof document.content !== 'string') {
+            conflicts.push('backend_document_snapshot_invalid');
+            continue;
+        }
+        const localContent = localDocuments[document.documentType];
+        if (!localContent || sha256(localContent) !== sha256(document.content)) {
+            conflicts.push(`backend_local_document_mismatch:${document.documentType}`);
+        }
+    }
+    return [...new Set(conflicts)].sort();
+}
+export function newMemoryResourceCandidate(entry, policy) {
+    const added = entry.status === '??' || /[ARC]/.test(entry.status);
+    if (!added) {
+        return [];
+    }
+    if (policy) {
+        const screen = policy.screenPathPatterns.some((pattern) => globMatches(entry.path, pattern));
+        const component = policy.componentPathPatterns.some((pattern) => globMatches(entry.path, pattern));
+        if (screen && component) {
+            throw new Error(`Resource discovery policy is ambiguous for path: ${entry.path}`);
+        }
+        if (screen) {
+            return [{ path: entry.path, kind: 'screen_logic' }];
+        }
+        if (component) {
+            return [{ path: entry.path, kind: 'component_mapping' }];
+        }
+        return [];
+    }
+    const extension = entry.path.toLowerCase().match(/\.[^.\/]+$/)?.[0];
+    if (!extension ||
+        !new Set([
+            '.dart',
+            '.ts',
+            '.tsx',
+            '.js',
+            '.jsx',
+            '.swift',
+            '.kt',
+            '.kts',
+            '.java',
+            '.cs',
+            '.go',
+            '.rs',
+            '.py',
+        ]).has(extension)) {
+        return [];
+    }
+    const segments = entry.path.toLowerCase().split('/').slice(0, -1);
+    const screenIndex = segments.findIndex((segment) => ['screen', 'screens', 'view', 'views'].includes(segment));
+    const componentIndex = segments.findIndex((segment) => ['widget', 'widgets', 'component', 'components'].includes(segment));
+    if (screenIndex >= 0 && (componentIndex < 0 || screenIndex < componentIndex)) {
+        return [{ path: entry.path, kind: 'screen_logic' }];
+    }
+    if (componentIndex >= 0) {
+        return [{ path: entry.path, kind: 'component_mapping' }];
+    }
+    return [];
+}
+function readResourceDiscoveryPolicy(snapshot, activeLease) {
+    const policy = objectValue(snapshot?.resourceDiscoveryPolicy) ??
+        objectValue(activeLease?.resourceDiscoveryPolicy);
+    const metadata = objectValue(policy?.metadata);
+    const discovery = objectValue(metadata?.resourceDiscovery) ?? policy;
+    if (!discovery) {
+        return null;
+    }
+    const screenPathPatterns = stringArray(discovery.screenPathPatterns);
+    const componentPathPatterns = stringArray(discovery.componentPathPatterns);
+    if (screenPathPatterns.length === 0 || componentPathPatterns.length === 0) {
+        throw new Error('Pinned resource discovery policy is incomplete');
+    }
+    return { screenPathPatterns, componentPathPatterns };
+}
+function stringArray(value) {
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string')) {
+        return [];
+    }
+    return [...new Set(value.filter((entry) => typeof entry === 'string'))].sort();
+}
+function globMatches(path, pattern) {
+    const normalizedPattern = pattern.replace(/\\/g, '/').replace(/^\.\//, '');
+    if (!normalizedPattern ||
+        normalizedPattern.startsWith('/') ||
+        /^[A-Za-z]:\//.test(normalizedPattern) ||
+        normalizedPattern.split('/').includes('..')) {
+        throw new Error(`Resource discovery pattern is unsafe: ${pattern}`);
+    }
+    return minimatch(path.replace(/\\/g, '/'), normalizedPattern, { dot: true });
+}
+function assertNewResourceEvidence(candidates, evidence) {
+    const normalizedEvidence = evidence.map((entry) => ({
+        ...entry,
+        path: normalizeChangedPaths([entry.path])[0],
+    }));
+    if (normalizedEvidence.some((entry) => entry.resourceKey.trim().length < 2)) {
+        throw new Error('New resource evidence requires a memory resource key');
+    }
+    if (new Set(normalizedEvidence.map((entry) => entry.path)).size !== normalizedEvidence.length) {
+        throw new Error('New resource evidence contains duplicate paths');
+    }
+    const expected = [...candidates].sort((left, right) => left.path.localeCompare(right.path));
+    const actual = normalizedEvidence
+        .map(({ path, kind }) => ({ path, kind }))
+        .sort((left, right) => left.path.localeCompare(right.path));
+    if (stableStringify(expected) !== stableStringify(actual)) {
+        throw new Error('New screen or shared component paths require exact memory reconciliation');
+    }
+}
+function assertValidationEvidence(validations) {
+    if (validations.length === 0) {
+        throw new Error('Validation evidence is required');
+    }
+    const allowed = new Set(validationIds);
+    const seen = new Set();
+    for (const validation of validations) {
+        if (!allowed.has(validation.validationId)) {
+            throw new Error(`Unknown validation evidence: ${validation.validationId}`);
+        }
+        if (seen.has(validation.validationId)) {
+            throw new Error(`Duplicate validation evidence: ${validation.validationId}`);
+        }
+        if (!validation.command.trim()) {
+            throw new Error(`Validation command is required: ${validation.validationId}`);
+        }
+        if (!/^[0-9a-f]{64}$/.test(validation.outputHash)) {
+            throw new Error(`Validation output hash is invalid: ${validation.validationId}`);
+        }
+        seen.add(validation.validationId);
+    }
+}
+//# sourceMappingURL=bridge-service.js.map