@zq-silk/yui 2.8.1 → 2.10.0

package/dist/controller/scheduleControl.js

@@ -0,0 +1,176 @@
+import { requireKnownFields } from "../domain/validation.js";
+import { nextScheduleDue, scheduleId, validateSchedule } from "../schedule/schedule.js";
+import { admitJobRun, authorizeDefinition, authorizeScope, createJobDefinitionControl } from "./jobDefinitionControl.js";
+import { jobAuthorityBinding } from "./jobControl.js";
+import { createGlobalRoleMessage } from "../message/message.js";
+import { createTaskEvent } from "../event/taskEvent.js";
+import { enqueueSupervisorEvent } from "../scheduler/operatorEvent.js";
+import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+function binding(store, caller, scope) {
+    return jobAuthorityBinding(store, caller.scope, caller.role, scope.kind === "task" ? scope.taskId : "");
+}
+function authorizeSchedule(store, schedule, caller, write) {
+    const job = store.getJobDefinition(schedule.scope, schedule.jobId);
+    if (job === null)
+        throw new Error("Schedule Job definition is missing.");
+    authorizeDefinition(store, job, caller, write);
+    return job;
+}
+function fence(schedule, now) {
+    return new Date(Math.max(now.getTime(), Date.parse(schedule?.processedThrough ?? "") || 0));
+}
+export function createScheduleControl(store, home) {
+    return (value, now) => {
+        if (value === null || typeof value !== "object" || Array.isArray(value))
+            throw new Error("Invalid Schedule request.");
+        requireKnownFields(value, ["op", "scope", "caller", "id", "jobId", "rule", "expectedRevision"], "Schedule request");
+        const input = value;
+        authorizeScope(store, input.scope, input.caller);
+        return store.transaction(tx => {
+            if (input.op === "list") {
+                return tx.listSchedules(input.scope).filter(s => {
+                    try {
+                        authorizeSchedule(tx, s, input.caller, false);
+                        return true;
+                    }
+                    catch {
+                        return false;
+                    }
+                });
+            }
+            scheduleId(input.id);
+            const previous = tx.getSchedule(input.scope, input.id);
+            if (input.op === "create") {
+                scheduleId(input.jobId);
+                const job = tx.getJobDefinition(input.scope, input.jobId);
+                if (job === null)
+                    throw new Error("Schedule Job definition is missing.");
+                if (previous !== null) {
+                    authorizeSchedule(tx, previous, input.caller, false);
+                    if (previous.jobId !== input.jobId || JSON.stringify(previous.rule) !== JSON.stringify(input.rule)) {
+                        throw new Error("Schedule id already exists; use update with its revision.");
+                    }
+                    return previous;
+                }
+                authorizeDefinition(tx, job, input.caller, true);
+                const due = nextScheduleDue(input.rule, now);
+                if (due === null)
+                    throw new Error("A new once Schedule must be in the future.");
+                const schedule = validateSchedule({
+                    schemaVersion: 1, id: input.id, scope: structuredClone(input.scope), jobId: input.jobId,
+                    rule: structuredClone(input.rule), state: "enabled", revision: 1, generation: 1, nextDue: due,
+                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision },
+                    createdAt: now.toISOString(), updatedAt: now.toISOString()
+                });
+                tx.saveSchedule(schedule);
+                return schedule;
+            }
+            if (previous === null)
+                throw new Error("Schedule not found.");
+            authorizeSchedule(tx, previous, input.caller, false);
+            if (input.op === "show") {
+                const runs = createJobDefinitionControl(tx, home)({
+                    op: "runs", scope: input.scope, id: previous.jobId, caller: input.caller
+                }, now);
+                const ownRuns = runs.filter(r => r.trigger.source === "schedule" && r.trigger.key.startsWith(`${previous.id}:`));
+                const lastSuccess = ownRuns.filter(r => r.status === "succeeded")
+                    .sort((a, b) => b.updatedAt.localeCompare(a.updatedAt))[0] ?? null;
+                return { schedule: previous, lastSuccess };
+            }
+            if (previous.revision !== input.expectedRevision)
+                throw new Error("Schedule revision changed; read it before modifying.");
+            let next;
+            if (input.op === "disable") {
+                next = { ...previous, state: "disabled", reason: "Explicitly disabled; no future admission. Existing Runs are unchanged." };
+            }
+            else if (input.op === "enable" || input.op === "update") {
+                if (input.op === "enable" && ["completed", "retired"].includes(previous.state)) {
+                    throw new Error("Completed/retired Schedule requires an explicit future rule update.");
+                }
+                const jobId = input.op === "update" ? input.jobId ?? previous.jobId : previous.jobId;
+                scheduleId(jobId);
+                const rule = input.op === "update" ? input.rule : previous.rule;
+                const job = authorizeSchedule(tx, { ...previous, jobId }, input.caller, true);
+                const after = fence(previous, now);
+                // Once overlap/disabled intent keeps its original due instant on enable.
+                const nextDue = input.op === "enable" && rule.kind === "once"
+                    ? previous.nextDue : nextScheduleDue(rule, after);
+                if (nextDue === null)
+                    throw new Error("Rule must have a future occurrence.");
+                next = {
+                    ...previous, jobId, rule: structuredClone(rule), nextDue,
+                    state: input.op === "enable" || previous.state === "enabled" ? "enabled" : "disabled",
+                    generation: previous.generation + (input.op === "update" ? 1 : 0),
+                    processedThrough: after.toISOString(),
+                    authorization: { caller: structuredClone(input.caller), binding: binding(tx, input.caller, input.scope), jobRevision: job.revision }
+                };
+                const { reason: _reason, ...withoutReason } = next;
+                next = withoutReason;
+            }
+            else
+                throw new Error(`Unknown Schedule operation: ${input.op}.`);
+            next = { ...next, revision: previous.revision + 1, updatedAt: now.toISOString() };
+            tx.saveSchedule(next);
+            return next;
+        });
+    };
+}
+/** One bounded pass in the existing Controller. Transactions never spawn. */
+export function reconcileSchedules(store, home, now, onError = () => { }, limit = 100) {
+    for (const candidate of store.listDueSchedules(now.toISOString(), limit)) {
+        try {
+            store.transaction(tx => {
+                const schedule = tx.getSchedule(candidate.scope, candidate.id);
+                if (schedule?.state !== "enabled" || schedule.nextDue === null || Date.parse(schedule.nextDue) > now.getTime())
+                    return;
+                const dueAt = schedule.nextDue;
+                const after = fence(schedule, now);
+                if (schedule.scope.kind === "task") {
+                    const task = tx.getTask(schedule.scope.taskId);
+                    if (task === null || task.status !== "active" || task.executionGate.state !== "enabled") {
+                        tx.saveSchedule({ ...schedule, state: "needs-attention", revision: schedule.revision + 1,
+                            reason: "Task execution unavailable; pending intent retained.", updatedAt: now.toISOString() });
+                        return;
+                    }
+                }
+                const job = authorizeSchedule(tx, schedule, schedule.authorization.caller, true);
+                if (job.revision !== schedule.authorization.jobRevision
+                    || binding(tx, schedule.authorization.caller, schedule.scope) !== schedule.authorization.binding) {
+                    throw new Error("Schedule authority or Job revision changed; inspect and explicitly enable.");
+                }
+                const result = admitJobRun(tx, home, schedule.scope, schedule.jobId, schedule.authorization.caller, { source: "schedule", key: `${schedule.id}:${schedule.generation}:${dueAt}` }, now);
+                const overlap = result.reason === "overlap";
+                const nextDue = overlap && schedule.rule.kind === "once" ? dueAt : nextScheduleDue(schedule.rule, after);
+                tx.saveSchedule({
+                    ...schedule, nextDue, state: nextDue === null ? "completed" : "enabled",
+                    processedThrough: after.toISOString(), revision: schedule.revision + 1,
+                    lastAttempt: { at: now.toISOString(), dueAt, outcome: overlap ? "overlap" : "admitted", runId: result.run.id },
+                    updatedAt: now.toISOString()
+                });
+            });
+        }
+        catch (error) {
+            const reason = redactLaunchText(error instanceof Error ? error.message : String(error));
+            // Admission/advancement rolled back together. Do not retry an unknown error.
+            store.transaction(tx => {
+                const current = tx.getSchedule(candidate.scope, candidate.id);
+                if (current?.state !== "enabled" || current.revision !== candidate.revision)
+                    return;
+                tx.saveSchedule({ ...current, state: "needs-attention", reason, revision: current.revision + 1,
+                    lastAttempt: { at: now.toISOString(), dueAt: current.nextDue, outcome: "blocked", reason },
+                    updatedAt: now.toISOString() });
+                if (current.scope.kind === "task") {
+                    const event = createTaskEvent(tx.nextEventId(current.scope.taskId), current.scope.taskId, "schedule.needs-attention", { scheduleId: current.id, reason }, now);
+                    tx.saveEvent(current.scope.taskId, event);
+                    enqueueSupervisorEvent(tx, event, "leader", "schedule-needs-attention", now);
+                }
+                else {
+                    tx.saveGlobalRoleMessage(createGlobalRoleMessage(tx.nextGlobalRoleMessageId(), "operator", `Yui-Summary: Schedule ${current.id} needs attention; no Run was admitted.\n`
+                        + `Reason: ${reason}\nRead: yui schedule show --global --schedule ${current.id}\n`
+                        + "Inspect the original intent before explicitly enabling; no new authority is implied.", "system", { type: "system" }, now, { inputControl: { action: "queue", requestId: `schedule-attention:${current.id}:${current.revision}` } }));
+                }
+            });
+            onError(new Error(`Schedule ${candidate.id} needs attention: ${reason}`, { cause: error }));
+        }
+    }
+}

package/dist/coordination/workMailbox.js

@@ -315,11 +315,11 @@ function parseTarget(value) {
 function parseRef(value, label) {
     const ref = record(value, label);
     const types = [
-        "task", "run", "work-item", "input", "session", "message", "event"
+        "task", "run", "work-item", "input", "session", "message", "event", "global-job-run"
     ];
     if (!types.includes(ref.type))
         throw new Error(`${label} type is invalid`);
-    if (ref.type === "task" || ref.type === "session") {
+    if (ref.type === "task" || ref.type === "session" || ref.type === "global-job-run") {
         exact(ref, ["type", "id"], label);
         return { type: ref.type, id: requireString(ref.id, `${label} id`) };
     }
@@ -360,7 +360,7 @@ function copyTarget(target) {
 }
 export function copyRef(ref) {
     if (!("taskId" in ref)) {
-        if (ref.type !== "task" && ref.type !== "session") {
+        if (ref.type !== "task" && ref.type !== "session" && ref.type !== "global-job-run") {
             throw new Error(`entity reference taskId is required for ${ref.type}`);
         }
         return { type: ref.type, id: requireText(ref.id, "entity reference id") };

package/dist/external/githubPublicationVerifier.js

@@ -1,5 +1,6 @@
 import { createExecFileCommandRunner, createPinnedCommandRunner } from "./pinnedCommandRunner.js";
 import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+import { canonicalPublicationUrl } from "../task/publicationToolObservation.js";
 const GIT_COMMIT = /^[0-9a-f]{40}$/iu;
 const GITHUB_REPOSITORY = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/u;
 const MAX_FAILURE_DETAIL_CHARS = 4_000;
@@ -20,22 +21,24 @@ async function inspectGitHubPullRequest(run, input) {
     if (!PULL_REQUEST_NUMBER.test(input.externalId)) {
         throw new Error(`GitHub pull request id must be numeric: ${input.externalId}.`);
     }
+    const hostname = input.externalUrl === undefined
+        ? "github.com" : new URL(canonicalPublicationUrl(input.externalUrl)).host;
     const result = await run("gh", [
         "pr", "view", input.externalId,
-        "--repo", input.repository,
-        "--json", "number,state,headRefOid,mergeCommit,mergedAt,url"
+        "--repo", `${hostname}/${input.repository}`,
+        "--json", "number,state,headRefOid,mergeCommit,mergedAt,url,baseRefName"
     ]);
     if (result.code !== 0) {
         if (result.code === 127) {
-            throw new Error("GitHub verification requires a trusted gh executable on PATH.");
+            throw new Error("The built-in GitHub adapter needs gh on PATH; alternatively record authorized tool evidence with task publication verify --observation.");
         }
         const detail = boundedFailureDetail(redactLaunchText(result.stderr || result.stdout).trim());
         throw new Error(`gh pr view failed for ${input.repository}#${input.externalId} `
             + `(exit ${result.code})${detail.length === 0 ? "" : `: ${detail}`}`);
     }
-    return parseGitHubPullRequest(result.stdout, input.repository, input.externalId);
+    return parseGitHubPullRequest(result.stdout, input.repository, input.externalId, hostname);
 }
-export function parseGitHubPullRequest(stdout, repository, externalId) {
+export function parseGitHubPullRequest(stdout, repository, externalId, expectedHost = "github.com") {
     let parsed;
     try {
         parsed = JSON.parse(stdout.trim());
@@ -60,6 +63,11 @@ export function parseGitHubPullRequest(stdout, repository, externalId) {
         throw new Error("Merged GitHub PR did not expose a merge commit.");
     }
     const externalUrl = optionalText(record.url);
+    if (externalUrl === undefined
+        || canonicalPublicationUrl(externalUrl, "github")
+            !== canonicalPublicationUrl(`https://${expectedHost}/${repository}/pull/${externalId}`, "github")) {
+        throw new Error("GitHub PR URL does not match the expected service, repository and PR.");
+    }
     const mergedAt = optionalText(record.mergedAt);
     return {
         provider: "github",
@@ -67,6 +75,7 @@ export function parseGitHubPullRequest(stdout, repository, externalId) {
         externalKind: "pull-request",
         externalId,
         ...(externalUrl === undefined ? {} : { externalUrl }),
+        ...(optionalText(record.baseRefName) === undefined ? {} : { targetBranch: optionalText(record.baseRefName) }),
         state,
         headCommit,
         ...(remoteCommit === undefined ? {} : { remoteCommit }),

package/dist/external/gitlabPublicationVerifier.js

@@ -1,5 +1,6 @@
 import { createExecFileCommandRunner, createPinnedCommandRunner } from "./pinnedCommandRunner.js";
 import { redactLaunchText } from "../runtime/launchDiagnostics.js";
+import { canonicalPublicationUrl } from "../task/publicationToolObservation.js";
 const GIT_COMMIT = /^[0-9a-f]{40}$/iu;
 const GITLAB_REPOSITORY = /^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)+$/u;
 const MAX_FAILURE_DETAIL_CHARS = 4_000;
@@ -30,7 +31,7 @@ async function inspectGitLabMergeRequest(run, input) {
     ]);
     if (result.code !== 0) {
         if (result.code === 127) {
-            throw new Error("GitLab verification requires a trusted glab executable on PATH.");
+            throw new Error("The built-in GitLab adapter needs glab on PATH; alternatively record authorized tool evidence with task publication verify --observation.");
         }
         const detail = boundedFailureDetail(redactLaunchText(result.stderr || result.stdout).trim());
         throw new Error(`glab api failed for ${input.repository}!${input.externalId} `
@@ -64,8 +65,13 @@ export function parseGitLabMergeRequest(stdout, repository, externalId, expected
     }
     const externalUrl = optionalText(record.web_url);
     assertGitLabReference(record.references, repository, externalId);
-    if (externalUrl !== undefined && expectedHost !== undefined) {
-        assertGitLabWebUrl(externalUrl, expectedHost, repository, externalId);
+    if (externalUrl !== undefined) {
+        const url = new URL(canonicalPublicationUrl(externalUrl));
+        // references.full and iid establish identity; web_url is a browser link,
+        // not a repository/MR path schema. The command also checks the candidate URL.
+        if (expectedHost !== undefined && url.host.toLowerCase() !== expectedHost.toLowerCase()) {
+            throw new Error(`GitLab MR web URL does not match service ${expectedHost}.`);
+        }
     }
     const mergedAt = optionalText(record.merged_at);
     return {
@@ -74,6 +80,7 @@ export function parseGitLabMergeRequest(stdout, repository, externalId, expected
         externalKind: "merge-request",
         externalId,
         ...(externalUrl === undefined ? {} : { externalUrl }),
+        ...(optionalText(record.target_branch) === undefined ? {} : { targetBranch: optionalText(record.target_branch) }),
         state,
         headCommit,
         ...(remoteCommit === undefined ? {} : { remoteCommit }),
@@ -102,21 +109,6 @@ function assertGitLabReference(value, repository, externalId) {
             + `${repository}!${externalId}.`);
     }
 }
-function assertGitLabWebUrl(value, expectedHost, repository, externalId) {
-    let url;
-    try {
-        url = new URL(value);
-    }
-    catch {
-        throw new Error("GitLab MR web URL is invalid.");
-    }
-    const expectedSuffix = `/${repository}/-/merge_requests/${externalId}`;
-    if ((url.protocol !== "https:" && url.protocol !== "http:")
-        || url.host.toLowerCase() !== expectedHost.toLowerCase()
-        || !url.pathname.endsWith(expectedSuffix)) {
-        throw new Error(`GitLab MR web URL does not match ${expectedHost}/${repository}!${externalId}.`);
-    }
-}
 function firstCommit(...values) {
     for (const value of values) {
         if (value === null || value === undefined || value === "")
@@ -139,17 +131,8 @@ function optionalText(value) {
 function gitLabHostname(externalUrl) {
     if (externalUrl === undefined)
         return undefined;
-    let url;
-    try {
-        url = new URL(externalUrl);
-    }
-    catch {
-        throw new Error(`GitLab external URL is invalid: ${externalUrl}.`);
-    }
-    if (url.protocol !== "https:" && url.protocol !== "http:") {
-        throw new Error(`GitLab external URL protocol is invalid: ${url.protocol}.`);
-    }
-    return url.hostname === "gitlab.com" ? undefined : url.host;
+    const url = new URL(canonicalPublicationUrl(externalUrl));
+    return url.host === "gitlab.com" ? undefined : url.host;
 }
 function boundedFailureDetail(value) {
     return value.length <= MAX_FAILURE_DETAIL_CHARS

package/dist/grant/taskAuthorization.js

@@ -13,6 +13,12 @@ export function taskAuthorizationSource(store, taskId, environment, messageId, p
         || task.executionGate?.state === "stopped") {
         throw usageError("Task authorization is unavailable in this lifecycle or execution gate.");
     }
+    return { ...readTaskAuthorizationMessage(store, taskId, messageId, purpose),
+        nativeSessionId: caller.nativeSessionId };
+}
+/** Shared source binding; interpreting the quoted authority remains the caller's
+ * responsibility. A matching quote proves provenance, not semantic permission. */
+export function readTaskAuthorizationMessage(store, taskId, messageId, purpose) {
     const message = store.listMessages(taskId).find(entry => entry.id === messageId);
     if (!message || !((message.kind === "user" && message.author.type === "user")
         || (message.kind === "operator" && message.author.type === "operator"))) {
@@ -29,8 +35,7 @@ export function taskAuthorizationSource(store, taskId, environment, messageId, p
             taskId: message.taskId, id: message.id, kind: message.kind,
             author: message.author, body: message.body, createdAt: message.createdAt
         })).digest("hex"),
-        purpose: purpose.trim(),
-        nativeSessionId: caller.nativeSessionId
+        purpose: purpose.trim()
     };
 }
 const RELEASE_ACTIONS = new Set([

package/dist/interaction/notificationPresentation.js

@@ -49,11 +49,11 @@ export function wakeChangeLabels(reasons) {
             }
         }))];
 }
-export function wakeMessages(wake, messages) {
+export function wakeMessages(wake, messages, history = false) {
     const ids = new Set(wake.refs?.filter(ref => ref.type === "message" && ref.taskId === wake.taskId).map(ref => ref.id));
     const from = Date.parse(wake.fromCursor), to = Date.parse(wake.toCursor);
-    return messages.filter(message => ids.has(message.id)
-        || Date.parse(message.createdAt) > from && Date.parse(message.createdAt) <= to);
+    return messages.filter(message => message.taskId === wake.taskId && (ids.has(message.id)
+        || (history || wake.refs === undefined) && Date.parse(message.createdAt) > from && Date.parse(message.createdAt) <= to));
 }
 export function taskNotificationPresentation(wake, store) {
     const messages = wakeMessages(wake, store.listMessages(wake.taskId));
@@ -69,6 +69,13 @@ export function taskNotificationPresentation(wake, store) {
         ...(messages.length > 4 ? [`${messages.length - 4} more messages in the fixed wake.`] : []),
         `Refresh: yui task context ${wake.taskId} --json`,
         `Read inputs/results: yui task wake show ${wake.taskId} ${wake.id} --json`,
+        `Handling: claim exact inbox entry ${wake.id}; after disposition, ack it with a concrete reason before ending this turn.`,
+        "Use yui inbox list --view current --json for current inputs. Historical missing receipts are not new work; never replay effects to repair an ACK.",
+        ...(wake.reasons.includes("session-replaced") ? [
+            "Session replacement is initialization, not replay or completion of earlier input.",
+            "Read yui inbox list --view history --json; inspect retained originals, prior effects and current authority before explicit settlement.",
+            "Preserve original claims and delivery targets. Unknown external effects require evidence, not another execution."
+        ] : []),
         "Check current Skills each turn: yui session skills --json. Apply current yui-leader; read relevant originals in full and advance authorized work."
     ].join("\n");
 }
@@ -80,6 +87,8 @@ export function globalMessagePresentation(roleName, messageId, message) {
         ...(summary === undefined ? [] : [`Author summary (message-body): ${JSON.stringify(summary)}`]),
         "Refresh Session Context using the current Manifest's loadCommand.",
         `Read original: yui role message show ${roleName} ${messageId} --json`,
+        `Handling: claim exact inbox entry ${messageId}; after disposition, ack it with a concrete reason before ending this turn.`,
+        "Routing to a Task or asking a necessary user question can settle this input without completing the Task. Missing ACK is not permission to repeat effects.",
         `The Global loadCommand checks current Skill versions each turn. Apply current ${roleName === "operator" ? "yui-operator" : "yui-runtime"} within existing authority.`
     ].join("\n");
 }

package/dist/interaction/operatorPresentation.js

@@ -16,6 +16,11 @@ export function createOperatorBatchPresentation(batchId, items) {
     };
 }
 function renderItem(item) {
+    if (item.kind === "global-job-run")
+        return [
+            `- Global Job Run ${item.run.status}: ${item.run.definitionId}/${item.run.id}`,
+            `  Inspect: yui job run-get --global --job ${item.run.definitionId} --run ${item.run.id}`
+        ];
     if (item.kind === "input-request") {
         const { request } = item;
         return [

package/dist/job/builtinJob.js

@@ -0,0 +1,58 @@
+import { fileURLToPath } from "node:url";
+import { requireKnownFields } from "../domain/validation.js";
+/**
+ * Controlled action compilation, not a shell/Agent plugin surface.
+ * Unknown actions fail closed; executable paths/argv are never caller supplied.
+ */
+export function prepareBuiltinJob(configuration, workspace, execution) {
+    if (configuration.action === "project.refresh") {
+        projectRefreshDigest(configuration);
+        // Runtime-owned Git discovery/authentication context, never caller input
+        // or arbitrary inherited credentials. Background Git cannot prompt.
+        const env = { GIT_TERMINAL_PROMPT: "0" };
+        for (const key of ["PATH", "HOME", "SSH_AUTH_SOCK", "XDG_CONFIG_HOME", "GIT_CONFIG_NOSYSTEM", "GIT_CONFIG_GLOBAL"]) {
+            if (process.env[key] !== undefined)
+                env[key] = process.env[key];
+        }
+        return {
+            workspace, env, head: "0".repeat(40),
+            steps: [{
+                    name: "project.refresh", command: `project.refresh ${configuration.projectId}`,
+                    argv: [process.execPath, fileURLToPath(new URL("./projectRefreshRunner.js", import.meta.url)),
+                        execution?.home ?? "", execution?.runId ?? ""],
+                    timeoutMs: 10 * 60_000
+                }]
+        };
+    }
+    if (configuration.action !== "system.noop")
+        throw new Error(`Unsupported builtin Job action: ${configuration.action}.`);
+    if (configuration.projectId !== undefined || JSON.stringify(configuration.input) !== "{}") {
+        throw new Error("system.noop accepts an empty input and no Project target.");
+    }
+    return {
+        workspace,
+        env: {},
+        // No source repository applies to this action. This explicit sentinel is
+        // never an Integration candidate or evidence of a Project revision.
+        head: "0".repeat(40),
+        steps: [{
+                name: "system.noop",
+                command: "system.noop",
+                argv: [process.execPath, "-e", "process.stdout.write('system.noop completed\\n')"],
+                timeoutMs: 5000
+            }]
+    };
+}
+export function projectRefreshDigest(configuration) {
+    if (!/^project-\d+$/u.test(configuration.projectId ?? ""))
+        throw new Error("project.refresh requires an exact Project ID.");
+    const input = configuration.input;
+    if (!input || typeof input !== "object" || Array.isArray(input))
+        throw new Error("Invalid project.refresh input.");
+    requireKnownFields(input, ["targetDigest"], "project.refresh input");
+    const digest = input.targetDigest;
+    if (typeof digest !== "string" || !/^[a-f0-9]{64}$/u.test(digest)) {
+        throw new Error("project.refresh requires its current catalog targetDigest.");
+    }
+    return digest;
+}