@zq-silk/yui 0.15.6 → 0.15.8

package/dist/task/task.js

@@ -1,4 +1,5 @@
 import { validateTaskWorkspaceIdentity } from "../repository/taskWorkspaceIdentity.js";
+import { cancelTaskActivationRequest, recordTaskActivationEvidence, validateTaskActivationRequest } from "./taskActivation.js";
 export function createTask(id, title, now, metadata = {}) {
     const timestamp = now.toISOString();
     return {
@@ -38,13 +39,106 @@ export function bindTaskWorkspaceIdentity(task, identity, now) {
         updatedAt: now.toISOString()
     });
 }
+/**
+ * How many terminal activation requests the Task payload *displays* beside its
+ * latest one.
+ *
+ * This is a display bound, not an authority. Whether a requestId was already
+ * cancelled or adopted is answered from the durable activation event ledger,
+ * which is never compacted, so overflow trims only what the payload shows, never
+ * what replay enforcement can see: an evicted entry is still refused. The oldest
+ * request is not "least likely to be replayed" — it is simply the oldest, and it
+ * keeps its authority exactly like the newest.
+ */
+export const MAX_SETTLED_ACTIVATION_REQUESTS = 16;
+/** Terminal dispositions: the request will never adopt again on its own. */
+function isSettledActivationRequest(request) {
+    return request.disposition === "cancelled" || request.disposition === "adopted";
+}
+/**
+ * Persists the Task's latest activation request.
+ *
+ * The request is intent only, so this never touches `status`: a Draft stays a
+ * continuable Draft after a request is recorded, cancelled, or failed. Only
+ * `activateTask` inside the adoption transaction moves the lifecycle.
+ *
+ * A request being displaced from the slot is projected into the bounded settled
+ * history when its outcome was terminal, so the recent decisions stay visible on
+ * the Task payload. This history is a display projection, not the authority:
+ * whether a cancelled or adopted id may be replayed is decided from the durable
+ * activation event ledger, so trimming the oldest entries here never lets a
+ * decided outcome be replayed away. A `failed` request is deliberately not
+ * projected: it stays replayable by contract, and it is still in the slot until
+ * something replaces it.
+ */
+export function setTaskActivationRequest(task, request, now) {
+    validateTask(task);
+    const valid = validateTaskActivationRequest(request);
+    if (valid.operation.targetId !== task.id) {
+        throw new Error(`Activation request belongs to another Task: ${valid.operation.targetId}.`);
+    }
+    const existing = task.activationRequest;
+    if (existing !== undefined
+        && existing.operation.requestId === valid.operation.requestId
+        && existing.operation.inputDigest !== valid.operation.inputDigest) {
+        throw new Error(`Activation requestId ${valid.operation.requestId} was already used for different inputs.`);
+    }
+    // Replacing the slot: keep the outgoing terminal outcome as evidence. The
+    // incoming request's own id is dropped from the history because it is now the
+    // slot's occupant, so exactly one record per id exists.
+    const displaced = existing !== undefined
+        && existing.operation.requestId !== valid.operation.requestId
+        && isSettledActivationRequest(existing)
+        ? [existing]
+        : [];
+    const retained = [
+        ...(task.settledActivationRequests ?? []),
+        ...displaced
+    ].filter(({ operation }) => operation.requestId !== valid.operation.requestId)
+        .slice(-MAX_SETTLED_ACTIVATION_REQUESTS);
+    return validateTask({
+        ...task,
+        activationRequest: valid,
+        ...(retained.length === 0 ? {} : { settledActivationRequests: retained }),
+        updatedAt: now.toISOString()
+    });
+}
+/**
+ * Records operation evidence against one activation request by id, wherever the
+ * Task still holds it — the live slot or the settled history.
+ *
+ * Evidence has to survive the request losing the slot: resources adopted for A
+ * remain adopted after A is cancelled and B is requested, and that effect must
+ * stay attached to A rather than following the slot to B. The underlying ratchet
+ * only raises `effect` and adds refs, so this never rewrites an outcome.
+ */
+export function recordTaskActivationRequestEvidence(task, requestId, evidence, now) {
+    const current = task.activationRequest;
+    if (current?.operation.requestId === requestId) {
+        const updated = recordTaskActivationEvidence(current, evidence, now);
+        if (updated === current)
+            return task;
+        return validateTask({ ...task, activationRequest: updated, updatedAt: now.toISOString() });
+    }
+    const settled = task.settledActivationRequests;
+    if (settled?.some(({ operation }) => operation.requestId === requestId) !== true) {
+        throw new Error(`Activation request not found on Task ${task.id}: ${requestId}.`);
+    }
+    return validateTask({
+        ...task,
+        settledActivationRequests: settled.map((request) => (request.operation.requestId === requestId
+            ? recordTaskActivationEvidence(request, evidence, now)
+            : request)),
+        updatedAt: now.toISOString()
+    });
+}
 export function activateTask(task, now) {
     if (task.status === "archived")
         throw new Error(`Cannot activate archived Task: ${task.id}.`);
     if (task.status === "completed")
         throw new Error(`Cannot activate completed Task ${task.id}; reopen it instead.`);
-    if (task.status === "retired")
-        throw new Error(`Cannot activate retired Task: ${task.id}.`);
+    if (task.status === "cancelled")
+        throw new Error(`Cannot activate cancelled Task ${task.id}; reopen it with user or Operator authority.`);
     if (task.status === "active")
         return task;
     return { ...task, status: "active", updatedAt: now.toISOString() };
@@ -146,7 +240,7 @@ export function retireTask(task, input, now) {
             throw new Error("A Task cannot replace itself.");
         }
     }
-    if (task.status === "retired") {
+    if (task.status === "cancelled") {
         if (task.retiredBy === by
             && task.retirementSummary === summary
             && task.replacementTaskId === input.replacementTaskId) {
@@ -160,10 +254,11 @@ export function retireTask(task, input, now) {
     const timestamp = now.toISOString();
     return validateTask({
         ...task,
-        status: "retired",
+        status: "cancelled",
         retiredAt: timestamp,
         retiredBy: by,
         retirementSummary: summary,
+        ...(input.isolated === true ? { retirementIsolation: true } : {}),
         ...(input.replacementTaskId === undefined
             ? {}
             : { replacementTaskId: input.replacementTaskId }),
@@ -183,24 +278,42 @@ export function completeTask(task, now, completion) {
         completedAt: timestamp,
         completedBy: completion.by,
         completionSummary: requireText(completion.summary, "Task completion summary"),
+        ...(completion.artifactRefs === undefined ? {} : {
+            completionArtifactRefs: completion.artifactRefs.map((ref) => requireText(ref, "Artifact ref"))
+        }),
         updatedAt: timestamp
     };
 }
 export function reopenTask(task, now) {
     if (task.status === "archived")
         throw new Error(`Cannot reopen archived Task: ${task.id}.`);
-    if (task.status !== "completed") {
-        throw new Error(`Only a completed Task can be reopened: ${task.id}.`);
-    }
-    const { completedAt: _completedAt, completedBy: _completedBy, completionSummary: _completionSummary, ...reopened } = task;
-    return { ...reopened, status: "active", updatedAt: now.toISOString() };
+    if (task.status !== "completed" && task.status !== "cancelled") {
+        throw new Error(`Only a completed or cancelled Task can be reopened: ${task.id}.`);
+    }
+    const { completedAt: _completedAt, completedBy: _completedBy, completionSummary: _completionSummary, completionArtifactRefs: _completionArtifactRefs, retiredAt: _retiredAt, retiredBy: _retiredBy, retirementSummary: _retirementSummary, replacementTaskId: _replacementTaskId, retirementIsolation: _retirementIsolation, ...reopened } = task;
+    // A request that never adopted is superseded by the completion it predates:
+    // it is cancelled rather than deleted, so it cannot be replayed into the new
+    // delivery cycle and the intent stays visible. An adopted request records a
+    // real environment and status change and is left exactly as it is.
+    const request = reopened.activationRequest;
+    return validateTask({
+        ...reopened,
+        ...(request?.disposition === "pending"
+            ? {
+                activationRequest: cancelTaskActivationRequest(request, `Task was completed and reopened at ${now.toISOString()}; request superseded.`, now)
+            }
+            : {}),
+        status: "active",
+        executionGate: { state: "enabled" },
+        updatedAt: now.toISOString()
+    });
 }
 export function archiveTask(task, now, archive) {
     if (task.status === "archived")
         return task;
     if (task.status !== "completed"
-        && task.status !== "retired") {
-        throw new Error(`Only a completed or retired Task can be archived: ${task.id}.`);
+        && task.status !== "cancelled") {
+        throw new Error(`Only a completed or cancelled Task can be archived: ${task.id}.`);
     }
     const timestamp = now.toISOString();
     return validateTask({
@@ -256,10 +369,22 @@ export function isTaskArchived(task) {
 export function isTaskExecutionEnabled(task) {
     return task.executionGate.state === "enabled";
 }
+/**
+ * Whether this Task owns a managed Git workspace at all.
+ *
+ * A Task activated with an empty environment plan legitimately owns none: it
+ * binds no Project and adopted no directory, so there is no worktree to be
+ * ready and no cwd to verify. Workspace fences use this to distinguish "not
+ * prepared yet" from "correctly owns nothing", instead of creating a workspace
+ * only to satisfy the fence.
+ */
+export function taskOwnsManagedWorkspace(task) {
+    return task.projectBindings.length > 0 || task.cwd !== undefined;
+}
 export function stopTaskExecution(task, now) {
     validateTask(task);
-    if (task.status !== "active") {
-        throw new Error(`Only an active Task can be stopped: ${task.id}.`);
+    if (task.status !== "active" && task.status !== "draft") {
+        throw new Error(`Only an open Task can be stopped: ${task.id}.`);
     }
     if (task.executionGate.state === "stopped")
         return task;
@@ -271,8 +396,8 @@ export function stopTaskExecution(task, now) {
 }
 export function startTaskExecution(task, now) {
     validateTask(task);
-    if (task.status !== "active") {
-        throw new Error(`Only an active Task can be started: ${task.id}.`);
+    if (task.status !== "active" && task.status !== "draft") {
+        throw new Error(`Only an open Task can be started: ${task.id}.`);
     }
     if (task.executionGate.state === "enabled")
         return task;
@@ -289,7 +414,7 @@ export function validateTask(task) {
     requireText(task.title, "Task title");
     if (task.type !== undefined)
         requireSafeIdentity(task.type, "Task type");
-    if (!["draft", "active", "completed", "retired", "archived"].includes(task.status)) {
+    if (!["draft", "active", "completed", "cancelled", "archived"].includes(task.status)) {
         throw new Error(`Task status is invalid: ${String(task.status)}.`);
     }
     if (task.executionGate === null
@@ -299,6 +424,14 @@ export function validateTask(task) {
     }
     requireTimestamp(task.createdAt, "Task createdAt");
     requireTimestamp(task.updatedAt, "Task updatedAt");
+    if (task.retirementIsolation !== undefined && task.retirementIsolation !== true) {
+        throw new Error("Task retirement isolation must represent explicit established evidence.");
+    }
+    if (task.completionArtifactRefs !== undefined && !Array.isArray(task.completionArtifactRefs)) {
+        throw new Error("Task completion artifact refs must be an array.");
+    }
+    for (const ref of task.completionArtifactRefs ?? [])
+        requireText(ref, "Task completion artifact ref");
     if (Date.parse(task.updatedAt) < Date.parse(task.createdAt)) {
         throw new Error("Task updatedAt cannot precede createdAt.");
     }
@@ -308,6 +441,39 @@ export function validateTask(task) {
             throw new Error(`Task workspace identity belongs to another Task: ${identity.taskId}.`);
         }
     }
+    if (task.activationRequest !== undefined) {
+        const request = validateTaskActivationRequest(task.activationRequest);
+        if (request.operation.targetId !== task.id) {
+            throw new Error(`Task activation request belongs to another Task: ${request.operation.targetId}.`);
+        }
+    }
+    if (task.settledActivationRequests !== undefined) {
+        const settled = task.settledActivationRequests;
+        if (!Array.isArray(settled)) {
+            throw new Error("Task settled activation requests are invalid.");
+        }
+        if (settled.length > MAX_SETTLED_ACTIVATION_REQUESTS) {
+            throw new Error("Task settled activation requests exceed the bounded limit.");
+        }
+        const seen = new Set();
+        for (const entry of settled) {
+            const request = validateTaskActivationRequest(entry);
+            if (request.operation.targetId !== task.id) {
+                throw new Error(`Task settled activation request belongs to another Task: ${request.operation.targetId}.`);
+            }
+            if (!isSettledActivationRequest(request)) {
+                throw new Error("Task settled activation history retains only terminal requests: "
+                    + `${request.operation.requestId}/${request.disposition}.`);
+            }
+            // One record per id, and never a stale copy of the live slot: the slot is
+            // the only place a request that can still change is allowed to live.
+            if (seen.has(request.operation.requestId)
+                || request.operation.requestId === task.activationRequest?.operation.requestId) {
+                throw new Error(`Task activation request is duplicated: ${request.operation.requestId}.`);
+            }
+            seen.add(request.operation.requestId);
+        }
+    }
     if (task.priority !== undefined
         && !["low", "medium", "high", "urgent"].includes(task.priority)) {
         throw new Error(`Task priority is invalid: ${String(task.priority)}.`);
@@ -344,7 +510,7 @@ export function validateTask(task) {
     if (task.status === "completed" && !hasAllCompletion) {
         throw new Error("A completed Task requires completedAt, completedBy, and completionSummary.");
     }
-    if (["draft", "active", "retired"].includes(task.status)
+    if (["draft", "active", "cancelled"].includes(task.status)
         && hasAnyCompletion) {
         throw new Error(`Task completion metadata is invalid for ${task.status} status.`);
     }
@@ -355,7 +521,7 @@ export function validateTask(task) {
         task.replacementTaskId
     ];
     const hasAnyRetirement = retirementFields.some((value) => value !== undefined);
-    const retired = task.status === "retired";
+    const retired = task.status === "cancelled";
     const archivedRetirement = task.status === "archived" && hasAnyRetirement;
     if (retired || archivedRetirement) {
         if (task.retiredAt === undefined

package/dist/task/taskActivation.js

@@ -0,0 +1,301 @@
+import { createHash } from "node:crypto";
+import { isDeepStrictEqual } from "node:util";
+import { requireIdentity, requireTimestamp } from "../domain/validation.js";
+import { recordOperationEvidence, validateOperationFacts } from "../kernel/operationFacts.js";
+export const TASK_ACTIVATION_IMPLEMENTATION = Object.freeze({
+    id: "yui:task-activation",
+    generation: "1"
+});
+export const TASK_ACTIVATION_CAPABILITY = "task.activate";
+/**
+ * The durable activation event vocabulary.
+ *
+ * These events are the never-compacted authority for a request's terminal
+ * outcome, so the type strings are named constants shared by every emitter and
+ * every reader. A rename cannot silently desynchronise what adoption/cancel
+ * record from what replay enforcement reads back — which is exactly how the
+ * bounded display list used to lose authority once it overflowed.
+ */
+export const TASK_ACTIVATION_EVENT = Object.freeze({
+    requested: "task.activation-requested",
+    cancelled: "task.activation-cancelled",
+    adopted: "task.activation-adopted",
+    failed: "task.activation-failed"
+});
+/**
+ * The digest that decides whether a repeated requestId is the same request.
+ *
+ * It covers only what adoption actually consumes: the Task, the start mode and
+ * the resource configuration. Ordinary planning progress — a Brief edit, a new
+ * Decision, a changed current focus — deliberately does not appear here, so
+ * continuing to plan never invalidates an already-issued request.
+ */
+export function taskActivationInputDigest(taskId, input) {
+    return createHash("sha256").update(JSON.stringify([
+        taskId,
+        input.startMode,
+        input.afterPlanningRun ?? null,
+        canonicalEnvironmentPlan(input.environmentPlan)
+    ])).digest("hex");
+}
+export function createTaskActivationRequest(taskId, input, now) {
+    if (input.startMode === "after-planning-turn") {
+        if (input.afterPlanningRun === undefined) {
+            throw new Error("A deferred activation request must name its planning Turn.");
+        }
+    }
+    else if (input.afterPlanningRun !== undefined) {
+        throw new Error("An immediate activation request cannot defer to a planning Turn.");
+    }
+    const timestamp = now.toISOString();
+    return validateTaskActivationRequest({
+        schemaVersion: 1,
+        operation: {
+            requestId: input.requestId,
+            inputDigest: taskActivationInputDigest(taskId, input),
+            actorId: input.actorId,
+            authorityRef: input.authorityRef,
+            targetId: taskId,
+            capability: TASK_ACTIVATION_CAPABILITY,
+            implementation: TASK_ACTIVATION_IMPLEMENTATION,
+            effect: "none",
+            receiptRefs: [],
+            partialResultRefs: []
+        },
+        startMode: input.startMode,
+        ...(input.afterPlanningRun === undefined
+            ? {}
+            : { afterPlanningRun: input.afterPlanningRun }),
+        environmentPlan: canonicalEnvironmentPlan(input.environmentPlan),
+        disposition: "pending",
+        requestedAt: timestamp,
+        updatedAt: timestamp
+    });
+}
+/**
+ * Records that adoption completed. `effect` escalates to `confirmed` and never
+ * returns: a later launch failure is reported on the Task, not by erasing the
+ * fact that the environment and the active status were adopted.
+ */
+export function adoptTaskActivationRequest(request, evidence, now) {
+    if (request.disposition === "adopted")
+        return request;
+    if (request.disposition !== "pending" && request.disposition !== "failed") {
+        throw new Error(`Activation request is not adoptable: ${request.operation.requestId}.`);
+    }
+    return validateTaskActivationRequest({
+        ...request,
+        operation: recordOperationEvidence(request.operation, {
+            effect: "confirmed",
+            ...(evidence.receiptRefs === undefined ? {} : { receiptRefs: evidence.receiptRefs })
+        }),
+        disposition: "adopted",
+        ...(evidence.preparationId === undefined
+            ? {}
+            : { preparationId: evidence.preparationId }),
+        updatedAt: now.toISOString()
+    });
+}
+/**
+ * Records an attempt that did not adopt. The request stays replayable and the
+ * Task stays a continuable Draft; `effect` rises to `possible` only when the
+ * caller could not prove the resources were left untouched.
+ */
+export function failTaskActivationRequest(request, outcome, now, evidence = {}) {
+    if (request.disposition === "adopted") {
+        throw new Error(`Adopted activation cannot be reported as failed: ${request.operation.requestId}.`);
+    }
+    if (request.disposition === "cancelled")
+        return request;
+    return validateTaskActivationRequest({
+        ...request,
+        operation: recordOperationEvidence(request.operation, evidence),
+        disposition: "failed",
+        outcome: requireOutcome(outcome),
+        updatedAt: now.toISOString()
+    });
+}
+/**
+ * Records what an attempt really did, without changing its disposition.
+ *
+ * Adoption of resources and adoption of the request are separate moments, so a
+ * request that was cancelled or replaced after its environment was already
+ * adopted still has to carry that effect. This is the same monotonic evidence
+ * ratchet the other transitions use — it can only add refs and raise `effect`,
+ * never lower it and never rewrite the outcome.
+ */
+export function recordTaskActivationEvidence(request, evidence, now) {
+    const operation = recordOperationEvidence(request.operation, evidence);
+    if (isDeepStrictEqual(operation, request.operation))
+        return request;
+    return validateTaskActivationRequest({
+        ...request,
+        operation,
+        updatedAt: now.toISOString()
+    });
+}
+/** An explicitly cancelled request is never replayed, even if it is retried. */
+export function cancelTaskActivationRequest(request, outcome, now) {
+    if (request.disposition === "adopted") {
+        throw new Error(`Adopted activation cannot be cancelled: ${request.operation.requestId}.`);
+    }
+    if (request.disposition === "cancelled")
+        return request;
+    return validateTaskActivationRequest({
+        ...request,
+        disposition: "cancelled",
+        outcome: requireOutcome(outcome),
+        updatedAt: now.toISOString()
+    });
+}
+/**
+ * Re-checks a stored request against current facts immediately before adoption.
+ *
+ * Everything decided at request time is deliberately re-decided here: the Task
+ * may have been retired, execution may have been stopped, the request may have
+ * been cancelled while the planning Turn was still running. Resource-level
+ * rechecks stay with `prepare`/`adopt`, which own the grant and directory
+ * identity fences.
+ */
+export function admitTaskActivationRequest(task, request, planningRunIsActive) {
+    if (request === undefined)
+        return undefined;
+    if (request.disposition === "adopted" || request.disposition === "cancelled") {
+        return { disposition: "settled", request };
+    }
+    if (request.operation.targetId !== task.id) {
+        return {
+            disposition: "unavailable",
+            request,
+            reason: `Activation request targets another Task: ${request.operation.targetId}.`
+        };
+    }
+    if (task.status !== "draft") {
+        return {
+            disposition: "unavailable",
+            request,
+            reason: `Task is no longer a Draft: ${task.id}/${task.status}.`
+        };
+    }
+    if (task.executionGate.state !== "enabled") {
+        return {
+            disposition: "unavailable",
+            request,
+            reason: `Task execution is stopped: ${task.id}.`
+        };
+    }
+    if (request.afterPlanningRun !== undefined
+        && planningRunIsActive(request.afterPlanningRun)) {
+        return {
+            disposition: "deferred",
+            request,
+            afterPlanningRun: request.afterPlanningRun
+        };
+    }
+    return { disposition: "ready", request };
+}
+/**
+ * The durable terminal outcome for a requestId, read from the activation event
+ * ledger.
+ *
+ * `task.activation-cancelled` and `task.activation-adopted` are never compacted
+ * — only runtime-observation events are pruned — so this answers "was this id
+ * already settled?" for the entire life of the Task, no matter how many later
+ * requests displaced it from the bounded display payload. A `failed` request is
+ * intentionally absent here: it stays replayable by contract, so replaying it is
+ * not a resurrection of a decided outcome.
+ *
+ * A requestId reaches at most one terminal disposition — adoption and
+ * cancellation exclude each other by construction — so the first matching
+ * terminal event is authoritative.
+ */
+export function settledActivationFromEvents(events, requestId) {
+    for (const event of events) {
+        if (event.payload.requestId !== requestId)
+            continue;
+        if (event.type === TASK_ACTIVATION_EVENT.cancelled) {
+            return {
+                disposition: "cancelled",
+                ...(event.payload.reason === undefined ? {} : { outcome: event.payload.reason })
+            };
+        }
+        if (event.type === TASK_ACTIVATION_EVENT.adopted) {
+            return { disposition: "adopted" };
+        }
+    }
+    return undefined;
+}
+export function validateTaskActivationRequest(request) {
+    if (request.schemaVersion !== 1) {
+        throw new Error("Activation request must use schemaVersion 1.");
+    }
+    validateOperationFacts(request.operation);
+    if (request.operation.capability !== TASK_ACTIVATION_CAPABILITY) {
+        throw new Error("Activation request capability is invalid.");
+    }
+    if (!["immediate", "after-planning-turn"].includes(request.startMode)) {
+        throw new Error(`Activation start mode is invalid: ${String(request.startMode)}.`);
+    }
+    if ((request.startMode === "after-planning-turn")
+        !== (request.afterPlanningRun !== undefined)) {
+        throw new Error("Activation deferral must name exactly the planning Turn it waits for.");
+    }
+    if (request.afterPlanningRun !== undefined) {
+        requireIdentity(request.afterPlanningRun, "Activation planning Turn");
+    }
+    if (!["pending", "adopted", "cancelled", "failed"].includes(request.disposition)) {
+        throw new Error(`Activation disposition is invalid: ${String(request.disposition)}.`);
+    }
+    if (request.disposition === "adopted" && request.operation.effect !== "confirmed") {
+        throw new Error("An adopted activation must record a confirmed effect.");
+    }
+    if (request.preparationId !== undefined) {
+        requireIdentity(request.preparationId, "Activation preparation");
+        if (request.disposition !== "adopted") {
+            throw new Error("Only an adopted activation records the preparation it consumed.");
+        }
+    }
+    if (request.outcome !== undefined)
+        requireOutcome(request.outcome);
+    canonicalEnvironmentPlan(request.environmentPlan);
+    requireTimestamp(request.requestedAt, "Activation requestedAt");
+    requireTimestamp(request.updatedAt, "Activation updatedAt");
+    if (Date.parse(request.updatedAt) < Date.parse(request.requestedAt)) {
+        throw new Error("Activation updatedAt cannot precede requestedAt.");
+    }
+    return request;
+}
+/** Normalizes the plan so the digest never depends on key order. */
+export function canonicalEnvironmentPlan(plan) {
+    const kind = plan?.kind;
+    if (kind === "empty")
+        return { kind: "empty" };
+    if (kind === "scratch")
+        return { kind: "scratch" };
+    if (kind === "local") {
+        const local = plan;
+        if (!["read", "write"].includes(local.access)) {
+            throw new Error(`Environment plan access is invalid: ${String(local.access)}.`);
+        }
+        return {
+            kind: "local",
+            resourceId: requireIdentity(local.resourceId, "Environment plan resource"),
+            access: local.access
+        };
+    }
+    throw new Error(`Environment plan kind is invalid: ${String(kind)}.`);
+}
+export function describeEnvironmentPlan(plan) {
+    return plan.kind === "local"
+        ? `local ${plan.resourceId} (${plan.access})`
+        : plan.kind;
+}
+function requireOutcome(value) {
+    if (typeof value !== "string" || value.includes("\0")) {
+        throw new Error("Activation outcome is invalid.");
+    }
+    const normalized = value.trim();
+    if (normalized.length === 0)
+        throw new Error("Activation outcome is required.");
+    return normalized.slice(0, 2000);
+}