@lumenflow/cli 3.1.1 → 3.1.3

package/dist/wu-done.js

@@ -126,6 +126,63 @@ const MEMORY_CHECKPOINT_NOTES = {
     PRE_GATES: 'Pre-gates checkpoint for recovery if gates fail',
 };
 const MEMORY_SIGNAL_WINDOW_MS = 60 * 60 * 1000; // 1 hour for recent signals
+export const CHECKPOINT_GATE_MODES = {
+    OFF: 'off',
+    WARN: 'warn',
+    BLOCK: 'block',
+};
+const CHECKPOINT_GATE_CONFIG = {
+    PATH: 'memory.enforcement.require_checkpoint_for_done',
+    COMMAND_PREFIX: 'pnpm mem:checkpoint --wu',
+    WARN_TAG: 'WU-1998',
+};
+function buildCheckpointGateBlockMessage(id) {
+    return (`${STRING_LITERALS.NEWLINE}${LOG_PREFIX.DONE} ${EMOJI.FAILURE} No checkpoints found for ${id} session.${STRING_LITERALS.NEWLINE}` +
+        `${LOG_PREFIX.DONE} ${CHECKPOINT_GATE_CONFIG.PATH} is set to '${CHECKPOINT_GATE_MODES.BLOCK}'.${STRING_LITERALS.NEWLINE}` +
+        `${LOG_PREFIX.DONE} Create a checkpoint before completing: ${CHECKPOINT_GATE_CONFIG.COMMAND_PREFIX} ${id}${STRING_LITERALS.NEWLINE}`);
+}
+function buildCheckpointGateWarnMessages(id) {
+    return [
+        `${STRING_LITERALS.NEWLINE}${LOG_PREFIX.DONE} ${EMOJI.INFO} ${CHECKPOINT_GATE_CONFIG.WARN_TAG}: No prior checkpoints recorded for ${id} in this session.`,
+        `${LOG_PREFIX.DONE} A pre-gates checkpoint will be created automatically by wu:done.`,
+        `${LOG_PREFIX.DONE} For earlier crash recovery, run '${CHECKPOINT_GATE_CONFIG.COMMAND_PREFIX} ${id}' after each acceptance criterion, before gates, or every 30 tool calls.${STRING_LITERALS.NEWLINE}`,
+    ];
+}
+export function resolveCheckpointGateMode(mode) {
+    if (mode === CHECKPOINT_GATE_MODES.OFF) {
+        return CHECKPOINT_GATE_MODES.OFF;
+    }
+    if (mode === CHECKPOINT_GATE_MODES.BLOCK) {
+        return CHECKPOINT_GATE_MODES.BLOCK;
+    }
+    return CHECKPOINT_GATE_MODES.WARN;
+}
+export async function enforceCheckpointGateForDone({ id, workspacePath, mode, queryByWuFn = queryByWu, hasSessionCheckpointsFn = hasSessionCheckpoints, log = console.log, blocker = (message) => {
+    die(message);
+}, }) {
+    if (mode === CHECKPOINT_GATE_MODES.OFF) {
+        return;
+    }
+    let wuNodes;
+    try {
+        wuNodes = await queryByWuFn(workspacePath, id);
+        if (hasSessionCheckpointsFn(id, wuNodes)) {
+            return;
+        }
+    }
+    catch {
+        // Fail-open: checkpoint discovery issues should not block wu:done.
+        return;
+    }
+    if (mode === CHECKPOINT_GATE_MODES.BLOCK) {
+        blocker(buildCheckpointGateBlockMessage(id));
+        return;
+    }
+    const warnMessages = buildCheckpointGateWarnMessages(id);
+    for (const message of warnMessages) {
+        log(message);
+    }
+}
 function normalizeWUDocLike(doc) {
     if (!doc || typeof doc !== 'object') {
         return {};
@@ -2078,7 +2135,7 @@ function printStateHUD({ id, docMain, isBranchOnly, isDocsOnly, derivedWorktree,
     console.log(`\n${LOG_PREFIX.DONE} HUD: WU=${id} status=${yamlStatus} stamp=${stampExists} locked=${yamlLocked} mode=${mode} branch=${branch} worktree=${worktreeDisplay}`);
 }
 // eslint-disable-next-line sonarjs/cognitive-complexity -- Pre-existing complexity, refactor tracked separately
-async function main() {
+export async function main() {
     // Allow pre-push hook to recognize wu:done automation (WU-1030)
     process.env.LUMENFLOW_WU_TOOL = 'wu-done';
     // Validate CLI arguments and WU ID format (extracted to wu-done-validators.ts)
@@ -2198,39 +2255,14 @@ async function main() {
     });
     // Step 0: Run gates (WU-1215: extracted to executeGates function)
     const worktreePath = effectiveWorktreePath;
-    // WU-1471 AC3: Config-driven checkpoint gate (replaces WU-1943 hardcoded warn)
-    // Reads memory.enforcement.require_checkpoint_for_done from config:
-    //   'off'  - skip checkpoint check entirely
-    //   'warn' - warn but allow wu:done (default, fail-open)
-    //   'block' - fail wu:done if no checkpoints found
-    try {
-        const checkpointGateConfig = getConfig();
-        const requireCheckpoint = checkpointGateConfig.memory?.enforcement?.require_checkpoint_for_done ?? 'warn';
-        if (requireCheckpoint !== 'off') {
-            const wuNodes = await queryByWu(worktreePath || mainCheckoutPath, id);
-            if (!hasSessionCheckpoints(id, wuNodes)) {
-                if (requireCheckpoint === 'block') {
-                    die(`\n${LOG_PREFIX.DONE} ${EMOJI.FAILURE} No checkpoints found for ${id} session.\n` +
-                        `${LOG_PREFIX.DONE} memory.enforcement.require_checkpoint_for_done is set to 'block'.\n` +
-                        `${LOG_PREFIX.DONE} Create a checkpoint before completing: pnpm mem:checkpoint --wu ${id}\n`);
-                }
-                else {
-                    // 'warn' mode (default)
-                    console.log(`\n${LOG_PREFIX.DONE} ${EMOJI.WARNING} WU-1943: No checkpoints found for ${id} session.`);
-                    console.log(`${LOG_PREFIX.DONE} Consider using 'pnpm mem:checkpoint --wu ${id}' periodically for crash recovery.`);
-                    console.log(`${LOG_PREFIX.DONE} Checkpoint triggers: after each acceptance criterion, before gates, every 30 tool calls.\n`);
-                }
-            }
-        }
-    }
-    catch (checkpointErr) {
-        // Non-blocking in 'warn' mode: checkpoint check failure should not block wu:done
-        // In 'block' mode, die() already exited, so this only catches non-die errors
-        if (checkpointErr instanceof Error && checkpointErr.message?.includes('No checkpoints found')) {
-            throw checkpointErr; // Re-throw die() errors
-        }
-        // Otherwise silently allow - fail-open
-    }
+    // WU-1471 AC3 + WU-1998: Config-driven checkpoint gate with accurate warn-mode messaging.
+    const checkpointGateConfig = getConfig();
+    const requireCheckpoint = resolveCheckpointGateMode(checkpointGateConfig.memory?.enforcement?.require_checkpoint_for_done);
+    await enforceCheckpointGateForDone({
+        id,
+        workspacePath: worktreePath || mainCheckoutPath,
+        mode: requireCheckpoint,
+    });
     // WU-1663: Preparation complete - transition to gating state
     pipelineActor.send({ type: WU_DONE_EVENTS.PREPARATION_COMPLETE });
     // WU-1663: Wrap gates in try/catch to send pipeline failure event

package/dist/wu-edit.js

@@ -247,7 +247,7 @@ async function ensureCleanWorkingTree() {
  * Main entry point
  */
 // eslint-disable-next-line sonarjs/cognitive-complexity -- Pre-existing complexity, refactor tracked separately
-async function main() {
+export async function main() {
     const opts = parseArgs();
     const { id } = opts;
     console.log(`${PREFIX} Starting WU edit for ${id}`);

package/dist/wu-infer-lane.js

@@ -97,7 +97,7 @@ function loadWuYaml(id) {
             `  2. Fix YAML errors manually and retry`);
     }
 }
-async function main() {
+export async function main() {
     const args = parseArgs(process.argv);
     let codePaths = [];
     let description = '';

package/dist/wu-preflight.js

@@ -54,7 +54,7 @@ function detectWorktreePath(id) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const PREFIX = LOG_PREFIX.PREFLIGHT;
     // WU-1180: Use createWUParser for proper Commander help output
     const args = createWUParser({

package/dist/wu-prep.js

@@ -317,7 +317,7 @@ function printSuccessMessage(wuId, mainCheckout) {
 /**
  * Main entry point.
  */
-async function main() {
+export async function main() {
     // Parse arguments
     const args = createWUParser({
         name: 'wu-prep',

package/dist/wu-proto.js

@@ -220,7 +220,7 @@ function claimWU(wuId, lane) {
         die(`Failed to claim WU: ${error.message}`);
     }
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-proto',
         description: 'Create and claim a prototype WU with relaxed validation (rapid prototyping)',

package/dist/wu-prune.js

@@ -123,7 +123,7 @@ async function validateWorktree(wt) {
     }
     return { valid: true, warnings, errors };
 }
-async function main() {
+export async function main() {
     const args = parseArgs(process.argv);
     const PREFIX = LOG_PREFIX.PRUNE;
     if (args.help) {

package/dist/wu-recover.js

@@ -473,7 +473,7 @@ export async function executeRecoveryAction(action, wuId) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-recover',
         description: 'Analyze and fix WU state inconsistencies (WU-1090)',

package/dist/wu-release.js

@@ -47,7 +47,7 @@ export function clearClaimMetadataOnRelease(doc) {
 export function shouldUseBranchPrReleasePath(doc) {
     return shouldUseBranchPrStatePath(doc);
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-release',
         description: 'Release an orphaned WU from in_progress back to ready state for reclaiming',

package/dist/wu-repair.js

@@ -212,7 +212,7 @@ async function routeToRepairMode(options) {
     }
     return runConsistencyRepairMode(options);
 }
-async function main() {
+export async function main() {
     const options = createProgram();
     validateOptions(options);
     validateModeRequirements(options);

package/dist/wu-sandbox.js

@@ -11,14 +11,14 @@ import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
 import { parse as parseYaml } from 'yaml';
-import { createWUParser, WU_OPTIONS, resolveLocation, readWURaw, buildSandboxProfile, resolveSandboxBackendForPlatform, SANDBOX_BACKEND_IDS, createLinuxSandboxBackend, createMacosSandboxBackend, createWindowsSandboxBackend, } from '@lumenflow/core';
+import { createWUParser, WU_OPTIONS, resolveLocation, readWURaw, buildSandboxProfile, resolveSandboxBackendForPlatform, SANDBOX_BACKEND_IDS, createLinuxSandboxBackend, createMacosSandboxBackend, createWindowsSandboxBackend, WORKSPACE_CONFIG_FILE_NAME, WORKSPACE_V2_KEYS, } from '@lumenflow/core';
 import { WU_PATHS, defaultWorktreeFrom } from '@lumenflow/core/wu-paths';
 import { die } from '@lumenflow/core/error-handler';
 import { LOG_PREFIX, EXIT_CODES } from '@lumenflow/core/wu-constants';
 import { runCLI } from './cli-entry-point.js';
 const PREFIX = LOG_PREFIX.CLAIM.replace('wu-claim', 'wu:sandbox');
-const CONFIG_FILE = '.lumenflow.config.yaml';
 const DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR = 'LUMENFLOW_SANDBOX_ALLOW_UNSANDBOXED';
+const SOFTWARE_DELIVERY_KEY = WORKSPACE_V2_KEYS.SOFTWARE_DELIVERY;
 function toNormalizedAbsolute(targetPath) {
     const normalized = path.resolve(targetPath);
     return normalized.length > 1 && normalized.endsWith(path.sep)
@@ -36,41 +36,54 @@ function parsePolicyConfig(value) {
     }
     return value;
 }
-export function readSandboxPolicy(projectRoot) {
-    const configPath = path.join(projectRoot, CONFIG_FILE);
+function readWorkspaceSoftwareDelivery(projectRoot) {
+    const configPath = path.join(projectRoot, WORKSPACE_CONFIG_FILE_NAME);
     if (!existsSync(configPath)) {
-        return {
-            allowUnsandboxedEnvVar: DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR,
-            extraWritableRoots: [],
-            denyWritableRoots: [],
-        };
+        return null;
     }
     try {
-        const raw = parseYaml(readFileSync(configPath, 'utf8'));
-        const sandbox = parsePolicyConfig(raw?.sandbox);
-        const allowUnsandboxedEnvVar = typeof sandbox.allow_unsandboxed_fallback_env === 'string' &&
-            sandbox.allow_unsandboxed_fallback_env.trim() !== ''
-            ? sandbox.allow_unsandboxed_fallback_env.trim()
-            : DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR;
-        const extraWritableRoots = Array.isArray(sandbox.extra_writable_roots)
-            ? sandbox.extra_writable_roots.filter((value) => typeof value === 'string')
-            : [];
-        const denyWritableRoots = Array.isArray(sandbox.deny_writable_roots)
-            ? sandbox.deny_writable_roots.filter((value) => typeof value === 'string')
-            : [];
-        return {
-            allowUnsandboxedEnvVar,
-            extraWritableRoots,
-            denyWritableRoots,
-        };
+        const parsed = parseYaml(readFileSync(configPath, 'utf8'));
+        if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+            return null;
+        }
+        const workspace = parsed;
+        const softwareDelivery = workspace[SOFTWARE_DELIVERY_KEY];
+        if (!softwareDelivery ||
+            typeof softwareDelivery !== 'object' ||
+            Array.isArray(softwareDelivery)) {
+            return null;
+        }
+        return softwareDelivery;
     }
     catch {
+        return null;
+    }
+}
+export function readSandboxPolicy(projectRoot) {
+    const softwareDelivery = readWorkspaceSoftwareDelivery(projectRoot);
+    if (!softwareDelivery) {
         return {
             allowUnsandboxedEnvVar: DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR,
             extraWritableRoots: [],
             denyWritableRoots: [],
         };
     }
+    const sandbox = parsePolicyConfig(softwareDelivery.sandbox);
+    const allowUnsandboxedEnvVar = typeof sandbox.allow_unsandboxed_fallback_env === 'string' &&
+        sandbox.allow_unsandboxed_fallback_env.trim() !== ''
+        ? sandbox.allow_unsandboxed_fallback_env.trim()
+        : DEFAULT_ALLOW_UNSANDBOXED_ENV_VAR;
+    const extraWritableRoots = Array.isArray(sandbox.extra_writable_roots)
+        ? sandbox.extra_writable_roots.filter((value) => typeof value === 'string')
+        : [];
+    const denyWritableRoots = Array.isArray(sandbox.deny_writable_roots)
+        ? sandbox.deny_writable_roots.filter((value) => typeof value === 'string')
+        : [];
+    return {
+        allowUnsandboxedEnvVar,
+        extraWritableRoots,
+        denyWritableRoots,
+    };
 }
 export function extractSandboxCommandFromArgv(argv) {
     const separator = argv.indexOf('--');
@@ -244,7 +257,7 @@ export async function runWuSandbox(input) {
     }
     return runCommand(commandToRun, commandArgs, worktreePath);
 }
-async function main() {
+export async function main() {
     const options = parseWuSandboxOptions(process.argv);
     const exitCode = await runWuSandbox(options);
     process.exit(exitCode);

package/dist/wu-status.js

@@ -152,7 +152,7 @@ export function getStatusExitCode(context) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-status',
         description: 'Show WU status, location, and valid commands (WU-1090)',

package/dist/wu-unblock.js

@@ -114,7 +114,7 @@ function handleWorktreeCreation(args, doc) {
     }
     createWorktree(doc, worktreePath, branchName);
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-unblock',
         description: 'Unblock a work unit and move it from blocked to in-progress status',

package/dist/wu-unlock-lane.js

@@ -96,7 +96,7 @@ function showLaneStatus(lane) {
         console.log(`    pnpm wu:unlock-lane --lane "${lane}" --reason "<explanation>" --force`);
     }
 }
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-unlock-lane',
         description: 'Safely unlock a lane lock with audit logging',

package/dist/wu-validate.js

@@ -139,7 +139,7 @@ function validateAllWUs({ strict = true } = {}) {
 /**
  * Main entry point
  */
-async function main() {
+export async function main() {
     const args = createWUParser({
         name: 'wu-validate',
         description: 'Validate WU YAML files against schema (strict mode by default, WU-1329)',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lumenflow/cli",
-  "version": "3.1.1",
+  "version": "3.1.3",
   "description": "Command-line interface for LumenFlow workflow framework",
   "keywords": [
     "lumenflow",
@@ -142,11 +142,13 @@
     "workspace-init": "./dist/workspace-init.js",
     "config-set": "./dist/config-set.js",
     "config-get": "./dist/config-get.js",
+    "cloud-connect": "./dist/init.js",
     "lumenflow-onboard": "./dist/onboard.js",
     "onboard": "./dist/onboard.js"
   },
   "files": [
     "dist",
+    "packs",
     "templates",
     "LICENSE",
     "README.md"
@@ -176,12 +178,12 @@
     "xstate": "^5.28.0",
     "yaml": "^2.8.2",
     "zod": "^4.3.6",
-    "@lumenflow/agent": "3.1.1",
-    "@lumenflow/memory": "3.1.1",
-    "@lumenflow/metrics": "3.1.1",
-    "@lumenflow/kernel": "3.1.1",
-    "@lumenflow/initiatives": "3.1.1",
-    "@lumenflow/core": "3.1.1"
+    "@lumenflow/agent": "3.1.3",
+    "@lumenflow/core": "3.1.3",
+    "@lumenflow/initiatives": "3.1.3",
+    "@lumenflow/metrics": "3.1.3",
+    "@lumenflow/memory": "3.1.3",
+    "@lumenflow/kernel": "3.1.3"
   },
   "devDependencies": {
     "@vitest/coverage-v8": "^4.0.18",
@@ -197,8 +199,10 @@
     "access": "public"
   },
   "scripts": {
+    "sync:bundled-packs": "node scripts/sync-bundled-packs.mjs",
     "build": "tsc && node scripts/check-shebangs.mjs",
-    "build:dist": "tsup && node scripts/fix-entry-points.mjs && node scripts/check-shebangs.mjs",
+    "build:dist:deps": "pnpm --filter @lumenflow/metrics build && pnpm --filter @lumenflow/kernel build && pnpm --filter @lumenflow/core build && pnpm --filter @lumenflow/memory build && pnpm --filter @lumenflow/agent build && pnpm --filter @lumenflow/initiatives build",
+    "build:dist": "pnpm run clean && pnpm run build:dist:deps && tsup && node scripts/fix-entry-points.mjs && node scripts/check-shebangs.mjs",
     "pack:dist": "pnpm pack",
     "clean": "rm -rf dist *.tgz",
     "test": "vitest run",

package/packs/software-delivery/constants.ts

@@ -0,0 +1,10 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+
+export const SOFTWARE_DELIVERY_PACK_ID = 'software-delivery' as const;
+export const SOFTWARE_DELIVERY_PACK_VERSION = '0.1.0' as const;
+export const SOFTWARE_DELIVERY_DOMAIN = SOFTWARE_DELIVERY_PACK_ID;
+export const SOFTWARE_DELIVERY_POLICY_ID_PREFIX = `${SOFTWARE_DELIVERY_PACK_ID}.gate` as const;
+export const SOFTWARE_DELIVERY_MANIFEST_FILE_NAME = 'manifest.yaml' as const;
+export const SHA256_ALGORITHM = 'sha256' as const;
+export const UTF8_ENCODING = 'utf8' as const;

package/packs/software-delivery/extensions.ts

@@ -0,0 +1,140 @@
+// Copyright (c) 2026 Hellmai Ltd
+// SPDX-License-Identifier: AGPL-3.0-only
+
+import { SOFTWARE_DELIVERY_DOMAIN } from './constants.js';
+
+export const SOFTWARE_DELIVERY_EXTENSION_KEY = 'software_delivery';
+export const SOFTWARE_DELIVERY_EXPOSURES = ['ui', 'api', 'backend-only', 'documentation'] as const;
+
+interface Parser<T> {
+  parse(input: unknown): T;
+}
+
+export interface SoftwareDeliveryTests {
+  unit: string[];
+  e2e: string[];
+  manual: string[];
+}
+
+export interface SoftwareDeliveryTaskExtensions {
+  code_paths: string[];
+  tests: SoftwareDeliveryTests;
+  exposure: (typeof SOFTWARE_DELIVERY_EXPOSURES)[number];
+  worktree: string;
+  branch: string;
+}
+
+export interface SoftwareDeliveryTask {
+  domain: typeof SOFTWARE_DELIVERY_DOMAIN;
+  extensions: Record<string, unknown> & {
+    [SOFTWARE_DELIVERY_EXTENSION_KEY]: SoftwareDeliveryTaskExtensions;
+  };
+}
+
+function asRecord(input: unknown, label: string): Record<string, unknown> {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    throw new Error(`${label} must be an object.`);
+  }
+  return input as Record<string, unknown>;
+}
+
+function assertOnlyKeys(
+  record: Record<string, unknown>,
+  allowedKeys: readonly string[],
+  label: string,
+): void {
+  const allowed = new Set(allowedKeys);
+  for (const key of Object.keys(record)) {
+    if (!allowed.has(key)) {
+      throw new Error(`${label} has unrecognized key "${key}".`);
+    }
+  }
+}
+
+function parseNonEmptyString(value: unknown, label: string): string {
+  if (typeof value !== 'string' || value.trim().length === 0) {
+    throw new Error(`${label} must be a non-empty string.`);
+  }
+  return value;
+}
+
+function parseStringArray(value: unknown, label: string): string[] {
+  if (!Array.isArray(value)) {
+    throw new Error(`${label} must be an array.`);
+  }
+  return value.map((entry, index) => parseNonEmptyString(entry, `${label}[${index}]`));
+}
+
+function parseTests(input: unknown): SoftwareDeliveryTests {
+  const tests = asRecord(input, 'tests');
+  assertOnlyKeys(tests, ['unit', 'e2e', 'manual'], 'tests');
+  return {
+    unit: parseStringArray(tests.unit ?? [], 'tests.unit'),
+    e2e: parseStringArray(tests.e2e ?? [], 'tests.e2e'),
+    manual: parseStringArray(tests.manual ?? [], 'tests.manual'),
+  };
+}
+
+const ExposureSet = new Set<string>(SOFTWARE_DELIVERY_EXPOSURES);
+
+export const SoftwareDeliveryTaskExtensionsSchema: Parser<SoftwareDeliveryTaskExtensions> = {
+  parse(input: unknown): SoftwareDeliveryTaskExtensions {
+    const extension = asRecord(input, 'software delivery extension');
+    assertOnlyKeys(
+      extension,
+      ['code_paths', 'tests', 'exposure', 'worktree', 'branch'],
+      'software delivery extension',
+    );
+
+    const exposure = parseNonEmptyString(extension.exposure, 'exposure');
+    if (!ExposureSet.has(exposure)) {
+      throw new Error(`exposure must be one of: ${SOFTWARE_DELIVERY_EXPOSURES.join(', ')}`);
+    }
+
+    return {
+      code_paths: parseStringArray(extension.code_paths, 'code_paths'),
+      tests: parseTests(extension.tests),
+      exposure: exposure as (typeof SOFTWARE_DELIVERY_EXPOSURES)[number],
+      worktree: parseNonEmptyString(extension.worktree, 'worktree'),
+      branch: parseNonEmptyString(extension.branch, 'branch'),
+    };
+  },
+};
+
+export const TaskExtensionsOpaqueRecordSchema: Parser<Record<string, unknown>> = {
+  parse(input: unknown): Record<string, unknown> {
+    return asRecord(input, 'extensions');
+  },
+};
+
+export function extractSoftwareDeliveryExtensions(
+  extensions: Record<string, unknown> | undefined,
+): SoftwareDeliveryTaskExtensions {
+  const parsedExtensions = TaskExtensionsOpaqueRecordSchema.parse(extensions ?? {});
+  return SoftwareDeliveryTaskExtensionsSchema.parse(
+    parsedExtensions[SOFTWARE_DELIVERY_EXTENSION_KEY],
+  );
+}
+
+export const SoftwareDeliveryTaskSchema: Parser<SoftwareDeliveryTask> = {
+  parse(input: unknown): SoftwareDeliveryTask {
+    const task = asRecord(input, 'task');
+
+    if (task.domain !== SOFTWARE_DELIVERY_DOMAIN) {
+      throw new Error(`task.domain must be "${SOFTWARE_DELIVERY_DOMAIN}".`);
+    }
+
+    const parsedExtensions = TaskExtensionsOpaqueRecordSchema.parse(task.extensions);
+    const parsedSoftwareDeliveryExtensions = SoftwareDeliveryTaskExtensionsSchema.parse(
+      parsedExtensions[SOFTWARE_DELIVERY_EXTENSION_KEY],
+    );
+
+    return {
+      domain: SOFTWARE_DELIVERY_DOMAIN,
+      extensions: {
+        ...parsedExtensions,
+        [SOFTWARE_DELIVERY_EXTENSION_KEY]: parsedSoftwareDeliveryExtensions,
+      },
+    };
+  },
+};