akm-cli 0.9.1 → 0.9.2-alpha.2

package/dist/tasks/backends/schtasks.js

@@ -37,10 +37,12 @@ import { ConfigError } from "../../core/errors.js";
 import { getTaskLogDir } from "../../core/paths.js";
 import { resolveAkmInvocation } from "../resolve-akm-bin.js";
 import { parseSchedule, translateToSchtasks } from "../schedule.js";
-import { buildScheduledTaskInvocation, parseScheduledTaskArgv, resolveScheduledTaskContext, schedulerContextDescriptor, schedulerContextPath, } from "../scheduler-invocation.js";
+import { assertSchedulerExecutionEvidenceDigest, assertSchedulerExpectationIdentity, assertSchedulerMutationArtifact, assertSchedulerNativeArtifactCardinality, assertSchedulerNativeArtifactOwner, assertSchedulerRemovalArtifact, assertSchedulerRollbackArtifactCardinality, schedulerBindingNativeId, schedulerLogicalBindingId, schedulerLogicalBindingOwner, schedulerNativeArtifactKey, schedulerNativeBindingId, } from "../scheduler-binding.js";
+import { buildScheduledBindingInvocation, parseScheduledBindingArgv, resolveScheduledTaskContext, schedulerContextDescriptor, schedulerContextPath, } from "../scheduler-invocation.js";
 import { escapeXml, nodeExec, nodeFs, normalizeXmlForUtf16File, runOrThrow, } from "./exec-utils.js";
 export const DEFAULT_FOLDER_PREFIX = "\\akm\\";
 const SIGNATURE_PREFIX = "akm:v1:";
+const SCHTASKS_SNAPSHOT = Symbol("akm-schtasks-binding-snapshot");
 export function SCHTASKS_BACKEND(options = {}) {
     const exec = options.exec ?? defaultSchtasksExec();
     const fsLike = options.fs ?? defaultSchtasksFs();
@@ -50,10 +52,13 @@ export function SCHTASKS_BACKEND(options = {}) {
     const scheduledContext = options.scheduledContext ?? resolveScheduledTaskContext();
     const defaultContextPath = schedulerContextPath(schedulerContextDescriptor(scheduledContext, process.env.PATH ?? ""));
     const userSid = options.userSid ?? resolveCurrentUserSid(exec);
-    const taskName = (id) => `${folder}${id}`;
+    const taskName = (nativeId) => `${folder}${nativeId}`;
     return {
         name: "schtasks",
-        install(task, opts) {
+        install(task, opts, expected) {
+            if (expected)
+                assertSchedulerExpectationIdentity(expected, task);
+            const nativeId = schedulerBindingNativeId(task);
             const xml = normalizeXmlForUtf16File(buildSchtasksXml(task, akmArgv, logDir, {
                 folderPrefix: folder,
                 contextPath: opts?.contextPath ?? defaultContextPath,
@@ -61,29 +66,55 @@ export function SCHTASKS_BACKEND(options = {}) {
                 binding: [...(opts?.binding ?? akmArgv)],
                 ...(opts?.target !== undefined ? { target: opts.target } : {}),
             }));
-            const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(task.id), "/XML"], {
-                isOk: (r) => r.status === 0 || isMissingTaskResult(r),
-                message: (r) => `schtasks /Query failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
-            });
+            const initialArtifact = expected
+                ? assertSchedulerNativeArtifactCardinality(inspectSchtasksState(exec, folder, taskName).artifacts, nativeId, expected.state === "absent" ? 0 : 1)
+                : undefined;
+            const existingNativeId = expected ? initialArtifact?.nativeId : nativeId;
+            const query = existingNativeId
+                ? runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(existingNativeId), "/XML"], {
+                    isOk: (r) => r.status === 0 || isMissingTaskResult(r),
+                    message: (r) => `schtasks /Query failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
+                })
+                : { status: 1, stdout: "", stderr: "missing" };
+            if (expected) {
+                assertSchedulerMutationArtifact(query.status === 0 && existingNativeId ? schtasksArtifact(existingNativeId, query.stdout) : undefined, expected);
+            }
             let previous;
             if (query.status === 0) {
+                if (!expected) {
+                    assertSchedulerNativeArtifactOwner(nativeId, task, extractSchtasksInvocation(query.stdout)?.invocation);
+                }
                 const enabled = taskXmlEnabled(query.stdout);
                 if (enabled === undefined) {
-                    throw new ConfigError(`schtasks /Query returned an unreadable definition for "${taskName(task.id)}"; refusing to replace it.`, "INVALID_CONFIG_FILE");
+                    throw new ConfigError(`schtasks /Query returned an unreadable definition for "${taskName(nativeId)}"; refusing to replace it.`, "INVALID_CONFIG_FILE");
                 }
                 previous = { xml: normalizeXmlForUtf16File(query.stdout), enabled };
             }
             fsLike.ensureDir(logDir);
-            const tmpFile = path.join(fsLike.tmpdir(), `akm-task-${task.id}-${Date.now()}.xml`);
+            const tmpFile = path.join(fsLike.tmpdir(), `akm-task-${nativeId}-${Date.now()}.xml`);
             fsLike.writeFile(tmpFile, xml);
             try {
+                if (expected) {
+                    const finalArtifact = assertSchedulerNativeArtifactCardinality(inspectSchtasksState(exec, folder, taskName).artifacts, nativeId, expected.state === "absent" ? 0 : 1);
+                    const finalNativeId = finalArtifact?.nativeId;
+                    const current = finalNativeId
+                        ? runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(finalNativeId), "/XML"], {
+                            isOk: (result) => result.status === 0 || isMissingTaskResult(result),
+                            message: (result) => `schtasks /Query failed during final install CAS (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
+                        })
+                        : undefined;
+                    assertSchedulerMutationArtifact(current?.status === 0 && finalNativeId ? schtasksArtifact(finalNativeId, current.stdout) : undefined, expected);
+                }
+                else {
+                    assertSchtasksArtifactUnchanged(exec, taskName(nativeId), query, nativeId, task);
+                }
                 try {
                     // /F forces overwrite if a task with the same name exists.
-                    runOrThrow(exec, ["schtasks", "/Create", "/TN", taskName(task.id), "/XML", tmpFile, "/F"], {
+                    runOrThrow(exec, ["schtasks", "/Create", "/TN", taskName(nativeId), "/XML", tmpFile, "/F"], {
                         message: (r) => `schtasks /Create failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
                     });
                     if (!task.enabled) {
-                        runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(task.id), "/DISABLE"], {
+                        runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(nativeId), "/DISABLE"], {
                             message: (r) => `schtasks /Change /DISABLE failed: ${r.stderr || r.stdout || "no output"}.`,
                         });
                     }
@@ -92,7 +123,7 @@ export function SCHTASKS_BACKEND(options = {}) {
                     const rollbackErrors = [];
                     if (previous === undefined) {
                         try {
-                            const remove = exec.run(["schtasks", "/Delete", "/TN", taskName(task.id), "/F"]);
+                            const remove = exec.run(["schtasks", "/Delete", "/TN", taskName(nativeId), "/F"]);
                             if (remove.status !== 0 && !isMissingTaskResult(remove)) {
                                 rollbackErrors.push(new ConfigError(`schtasks /Delete during rollback failed: ${remove.stderr || remove.stdout || "no output"}.`, "INVALID_CONFIG_FILE"));
                             }
@@ -104,11 +135,11 @@ export function SCHTASKS_BACKEND(options = {}) {
                     else {
                         try {
                             fsLike.writeFile(tmpFile, previous.xml);
-                            runOrThrow(exec, ["schtasks", "/Create", "/TN", taskName(task.id), "/XML", tmpFile, "/F"], {
+                            runOrThrow(exec, ["schtasks", "/Create", "/TN", taskName(nativeId), "/XML", tmpFile, "/F"], {
                                 message: (r) => `schtasks /Create during rollback failed: ${r.stderr || r.stdout || "no output"}.`,
                             });
                             const stateFlag = previous.enabled ? "/ENABLE" : "/DISABLE";
-                            runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(task.id), stateFlag], {
+                            runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(nativeId), stateFlag], {
                                 message: (r) => `schtasks /Change ${stateFlag} during rollback failed: ${r.stderr || r.stdout || "no output"}.`,
                             });
                         }
@@ -127,78 +158,48 @@ export function SCHTASKS_BACKEND(options = {}) {
                 fsLike.removeFile(tmpFile);
             }
         },
-        uninstall(id) {
-            runOrThrow(exec, ["schtasks", "/Delete", "/TN", taskName(id), "/F"], {
+        uninstall(nativeId, expected) {
+            if (expected) {
+                assertSchedulerExpectationIdentity({ ...expected, state: "present" });
+                const artifact = assertSchedulerNativeArtifactCardinality(inspectSchtasksState(exec, folder, taskName).artifacts, nativeId, 1);
+                const currentNativeId = artifact?.nativeId ?? nativeId;
+                const current = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(currentNativeId), "/XML"], {
+                    isOk: (result) => result.status === 0 || isMissingTaskResult(result),
+                    message: (result) => `schtasks /Query failed during final removal ownership check (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
+                });
+                if (current.status !== 0) {
+                    throw new ConfigError(`Task Scheduler artifact ${JSON.stringify(nativeId)} disappeared after coherent inspection.`, "INVALID_CONFIG_FILE");
+                }
+                assertSchedulerRemovalArtifact(currentNativeId, expected, extractSchtasksInvocation(current.stdout)?.invocation, installedSignature(current.stdout));
+            }
+            runOrThrow(exec, ["schtasks", "/Delete", "/TN", taskName(nativeId), "/F"], {
                 isOk: (r) => r.status === 0 || /cannot find/i.test(r.stderr ?? ""),
                 message: (r) => `schtasks /Delete failed: ${r.stderr || r.stdout || "no output"}.`,
             });
         },
-        setEnabled(id, enabled) {
+        setEnabled(nativeId, enabled) {
             const flag = enabled ? "/ENABLE" : "/DISABLE";
-            runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(id), flag], {
+            runOrThrow(exec, ["schtasks", "/Change", "/TN", taskName(nativeId), flag], {
                 message: (r) => `schtasks /Change ${flag} failed: ${r.stderr || r.stdout || "no output"}.`,
             });
         },
         list() {
-            const r = runOrThrow(exec, ["schtasks", "/Query", "/FO", "CSV", "/NH"], {
-                message: (res) => `schtasks /Query failed (exit ${res.status}): ${res.stderr || res.stdout || "no output"}.`,
-            });
-            const ids = [];
-            for (const line of (r.stdout ?? "").split(/\r?\n/)) {
-                const m = line.match(/^"([^"]+)",/);
-                if (!m)
-                    continue;
-                const name = m[1];
-                if (name.startsWith(folder)) {
-                    ids.push(name.slice(folder.length));
-                }
-            }
-            const refs = [];
-            for (const id of ids) {
-                const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(id), "/XML"], {
-                    message: (r) => `schtasks /Query /XML for "${taskName(id)}" failed (exit ${r.status}): ${r.stderr || r.stdout || "no output"}.`,
-                });
-                const signature = installedSignature(query.stdout);
-                const installed = extractSchtasksInvocation(query.stdout);
-                // An invocation that no longer parses (e.g. a pre-0.9 `tasks run`
-                // entry surviving the scheduler-ABI respelling) is an orphan of its
-                // marker id, not a hard failure: omit it so `akmTasksSync` treats the
-                // id as "not present" and reinstalls it from the current task file.
-                if (!installed)
-                    continue;
-                refs.push({
-                    id,
-                    ...(signature !== undefined ? { signature } : {}),
-                    ...(installed.target !== undefined ? { target: installed.target } : {}),
-                    binding: installed.binding,
-                    contextPath: installed.contextPath,
-                });
-            }
-            return refs;
+            return [...inspectSchtasksState(exec, folder, taskName).installed];
         },
         listForRebind() {
-            const r = runOrThrow(exec, ["schtasks", "/Query", "/FO", "CSV", "/NH"], {
-                message: (res) => `schtasks /Query failed (exit ${res.status}): ${res.stderr || res.stdout || "no output"}.`,
-            });
-            const refs = [];
-            for (const line of (r.stdout ?? "").split(/\r?\n/)) {
-                const match = line.match(/^"([^"]+)",/);
-                const name = match?.[1];
-                if (!name?.startsWith(folder))
-                    continue;
-                const id = name.slice(folder.length);
-                const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(id), "/XML"], {
-                    message: (result) => `schtasks /Query /XML for "${taskName(id)}" failed (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
-                });
-                const signature = installedSignature(query.stdout);
-                const installed = extractSchtasksInvocation(query.stdout);
-                refs.push({
-                    id,
-                    ...(signature !== undefined ? { signature } : {}),
-                    ...(installed?.target !== undefined ? { target: installed.target } : {}),
-                });
-            }
-            return refs;
+            return listSchtasksForRebind(exec, folder, taskName);
+        },
+        listNativeArtifacts() {
+            return [...inspectSchtasksState(exec, folder, taskName).artifacts];
+        },
+        inspectBindings() {
+            return inspectSchtasksState(exec, folder, taskName);
+        },
+        snapshotBindings(ids) {
+            return snapshotSchtasksBindings(ids, exec, folder, taskName);
+        },
+        restoreBindings(snapshot, expectedCurrent) {
+            restoreSchtasksBindings(snapshot, { exec, fsLike, folder, taskName }, expectedCurrent);
         },
         expectedSignature(task, opts) {
             const signature = taskXmlSignature(buildSchtasksXml(task, akmArgv, logDir, {
@@ -214,6 +215,181 @@ export function SCHTASKS_BACKEND(options = {}) {
         },
     };
 }
+function listSchtasksForRebind(exec, folder, taskName) {
+    const result = runOrThrow(exec, ["schtasks", "/Query", "/FO", "CSV", "/NH"], {
+        message: (query) => `schtasks /Query failed (exit ${query.status}): ${query.stderr || query.stdout || "no output"}.`,
+    });
+    const refs = [];
+    for (const line of (result.stdout ?? "").split(/\r?\n/)) {
+        const name = line.match(/^"([^"]+)",/)?.[1];
+        if (!name?.startsWith(folder))
+            continue;
+        const id = name.slice(folder.length);
+        const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(id), "/XML"], {
+            message: (current) => `schtasks /Query /XML for "${taskName(id)}" failed (exit ${current.status}): ${current.stderr || current.stdout || "no output"}.`,
+        });
+        const signature = installedSignature(query.stdout);
+        const installed = extractSchtasksInvocation(query.stdout);
+        const ref = {
+            id: installed ? schedulerLogicalBindingId(id, installed.invocation) : id,
+            ...(signature !== undefined ? { signature } : {}),
+            ...(installed?.target !== undefined ? { target: installed.target } : {}),
+        };
+        Object.defineProperty(ref, "nativeId", { value: id });
+        if (installed)
+            Object.defineProperty(ref, "invocation", { value: Object.freeze([...installed.invocation]) });
+        refs.push(ref);
+    }
+    return refs;
+}
+function inspectSchtasksState(exec, folder, taskName) {
+    const listing = runOrThrow(exec, ["schtasks", "/Query", "/FO", "CSV", "/NH"], {
+        message: (result) => `schtasks /Query failed (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
+    });
+    const installed = [];
+    const artifacts = [];
+    for (const nativeId of schtasksNativeIds(listing.stdout, folder)) {
+        const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(nativeId), "/XML"], {
+            message: (result) => `schtasks /Query /XML for "${taskName(nativeId)}" failed (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
+        });
+        const artifact = schtasksArtifact(nativeId, query.stdout);
+        artifacts.push(artifact);
+        const parsed = extractSchtasksInvocation(query.stdout);
+        if (!parsed)
+            continue;
+        const ref = {
+            id: schedulerLogicalBindingId(nativeId, parsed.invocation),
+            ...(artifact.fingerprint !== undefined ? { signature: artifact.fingerprint } : {}),
+            ...(parsed.target !== undefined ? { target: parsed.target } : {}),
+            binding: parsed.binding,
+            contextPath: parsed.contextPath,
+        };
+        Object.defineProperty(ref, "nativeId", { value: nativeId });
+        Object.defineProperty(ref, "invocation", { value: Object.freeze([...parsed.invocation]) });
+        installed.push(ref);
+    }
+    return Object.freeze({ installed: Object.freeze(installed), artifacts: Object.freeze(artifacts) });
+}
+function schtasksNativeIds(stdout, folder) {
+    const ids = [];
+    for (const line of (stdout ?? "").split(/\r?\n/)) {
+        const match = line.match(/^"([^"]+)",/);
+        const name = match?.[1];
+        if (name?.startsWith(folder))
+            ids.push(name.slice(folder.length));
+    }
+    return ids;
+}
+function schtasksArtifact(nativeId, xml) {
+    const parsed = extractSchtasksInvocation(xml);
+    const owner = parsed ? schedulerLogicalBindingOwner(nativeId, parsed.invocation) : undefined;
+    const artifact = parsed
+        ? {
+            nativeId,
+            ...(owner !== undefined ? { bindingId: owner } : {}),
+            invocation: Object.freeze([...parsed.invocation]),
+        }
+        : { nativeId };
+    const fingerprint = installedSignature(xml);
+    if (fingerprint !== undefined)
+        Object.defineProperty(artifact, "fingerprint", { value: fingerprint });
+    return artifact;
+}
+function snapshotSchtasksBindings(ids, exec, folder, taskName) {
+    const listing = runOrThrow(exec, ["schtasks", "/Query", "/FO", "CSV", "/NH"], {
+        message: (result) => `schtasks /Query failed while snapshotting bindings (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
+    });
+    const requestedKeys = new Set(ids.map(schedulerNativeArtifactKey));
+    const enumeratedIds = new Set(ids);
+    for (const nativeId of schtasksNativeIds(listing.stdout, folder)) {
+        if (requestedKeys.has(schedulerNativeArtifactKey(nativeId)))
+            enumeratedIds.add(nativeId);
+    }
+    const entries = [...enumeratedIds].map((id) => {
+        const query = runOrThrow(exec, ["schtasks", "/Query", "/TN", taskName(id), "/XML"], {
+            isOk: (result) => result.status === 0 || isMissingTaskResult(result),
+            message: (result) => `schtasks /Query failed while snapshotting "${taskName(id)}": ${result.stderr || result.stdout || "no output"}.`,
+        });
+        if (query.status !== 0)
+            return Object.freeze({ id });
+        const enabled = taskXmlEnabled(query.stdout);
+        if (enabled === undefined) {
+            throw new ConfigError(`schtasks /Query returned an unreadable definition while snapshotting "${taskName(id)}".`, "INVALID_CONFIG_FILE");
+        }
+        return Object.freeze({ id, xml: normalizeXmlForUtf16File(query.stdout), enabled });
+    });
+    const artifacts = entries.flatMap((entry) => entry.xml === undefined ? [] : [schtasksArtifact(entry.id, entry.xml)]);
+    return Object.freeze({
+        kind: SCHTASKS_SNAPSHOT,
+        nativeIds: Object.freeze([...ids]),
+        artifacts: Object.freeze(artifacts),
+        entries: Object.freeze(entries),
+    });
+}
+function restoreSchtasksBindings(snapshot, context, expectedCurrent) {
+    if (!isSchtasksBindingSnapshot(snapshot)) {
+        throw new ConfigError("Invalid Task Scheduler snapshot.", "INVALID_CONFIG_FILE");
+    }
+    const errors = [];
+    let rollbackInventory;
+    if (expectedCurrent) {
+        try {
+            rollbackInventory = inspectSchtasksState(context.exec, context.folder, context.taskName);
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    for (const entry of snapshot.entries) {
+        try {
+            if (expectedCurrent) {
+                if (!rollbackInventory)
+                    continue;
+                const expected = expectedCurrent.find((candidate) => candidate.nativeId === entry.id);
+                if (!expected) {
+                    throw new ConfigError(`Missing Task Scheduler rollback expectation for ${JSON.stringify(entry.id)}.`, "INVALID_CONFIG_FILE");
+                }
+                assertSchedulerRollbackArtifactCardinality(rollbackInventory.artifacts, expected);
+            }
+            restoreSchtasksEntry(entry, context);
+        }
+        catch (error) {
+            errors.push(error);
+        }
+    }
+    if (errors.length > 0) {
+        throw new AggregateError(errors, `Failed to completely restore ${errors.length} Task Scheduler operation(s).`);
+    }
+}
+function restoreSchtasksEntry(entry, context) {
+    if (entry.xml === undefined) {
+        runOrThrow(context.exec, ["schtasks", "/Delete", "/TN", context.taskName(entry.id), "/F"], {
+            isOk: (result) => result.status === 0 || isMissingTaskResult(result),
+            message: (result) => `schtasks /Delete failed while restoring "${context.taskName(entry.id)}": ${result.stderr || result.stdout || "no output"}.`,
+        });
+        return;
+    }
+    const tmpFile = path.join(context.fsLike.tmpdir(), `akm-task-restore-${schedulerNativeBindingId(entry.id)}-${Date.now()}.xml`);
+    context.fsLike.writeFile(tmpFile, entry.xml);
+    try {
+        runOrThrow(context.exec, ["schtasks", "/Create", "/TN", context.taskName(entry.id), "/XML", tmpFile, "/F"], {
+            message: (result) => `schtasks /Create failed while restoring "${context.taskName(entry.id)}": ${result.stderr || result.stdout || "no output"}.`,
+        });
+        const stateFlag = entry.enabled === false ? "/DISABLE" : "/ENABLE";
+        runOrThrow(context.exec, ["schtasks", "/Change", "/TN", context.taskName(entry.id), stateFlag], {
+            message: (result) => `schtasks /Change ${stateFlag} failed while restoring "${context.taskName(entry.id)}": ${result.stderr || result.stdout || "no output"}.`,
+        });
+    }
+    finally {
+        context.fsLike.removeFile(tmpFile);
+    }
+}
+function isSchtasksBindingSnapshot(value) {
+    return (typeof value === "object" &&
+        value !== null &&
+        value.kind === SCHTASKS_SNAPSHOT &&
+        Array.isArray(value.entries));
+}
 /**
  * Recover the bundle name embedded as a `--bundle <bundle>` pair in the
  * PowerShell `<Arguments>` of an installed Task Scheduler definition. Returns
@@ -230,7 +406,7 @@ export function extractSchtasksInvocation(xml) {
     const invocationStart = findPowerShellInvocationOperator(commandLine);
     if (invocationStart === undefined)
         return undefined;
-    return parseScheduledTaskArgv(parsePowerShellSingleQuotedArgs(commandLine, invocationStart + 1));
+    return parseScheduledBindingArgv(parsePowerShellSingleQuotedArgs(commandLine, invocationStart + 1));
 }
 function findPowerShellInvocationOperator(script) {
     let inSingleQuote = false;
@@ -285,13 +461,32 @@ function parsePowerShellSingleQuotedArgs(script, start) {
     }
     return argv;
 }
+/** Close the read/prepare-to-/Create ownership race at the native boundary. */
+function assertSchtasksArtifactUnchanged(exec, nativeTaskName, previous, nativeId, task) {
+    // This runs outside install's rollback region: no scheduler mutation has
+    // occurred, so a raced owner must remain untouched rather than be restored
+    // from the stale first read.
+    const current = runOrThrow(exec, ["schtasks", "/Query", "/TN", nativeTaskName, "/XML"], {
+        isOk: (result) => result.status === 0 || isMissingTaskResult(result),
+        message: (result) => `schtasks /Query failed during final ownership check (exit ${result.status}): ${result.stderr || result.stdout || "no output"}.`,
+    });
+    const changed = current.status !== previous.status ||
+        (current.status === 0 && normalizeXmlForUtf16File(current.stdout) !== normalizeXmlForUtf16File(previous.stdout));
+    if (changed) {
+        throw new ConfigError(`schtasks task "${nativeTaskName}" changed while it was being prepared; refusing to replace an unverified owner.`, "INVALID_CONFIG_FILE");
+    }
+    if (current.status === 0) {
+        assertSchedulerNativeArtifactOwner(nativeId, task, extractSchtasksInvocation(current.stdout)?.invocation);
+    }
+}
 export function buildSchtasksXml(task, akmArgv, logDir, options) {
     const folder = options.folderPrefix ?? DEFAULT_FOLDER_PREFIX;
     const now = options.now ? options.now() : new Date();
     const definition = buildSchtasksDefinition(task, options.binding ?? akmArgv, logDir, folder, options.contextPath, options.userSid, options.target);
     const triggerXml = renderSchtasksTrigger(definition.trigger, now);
+    const nativeId = schedulerBindingNativeId(task);
     return schtasksTemplate
-        .replaceAll("{{TASK_ID}}", escapeXml(task.id))
+        .replaceAll("{{TASK_ID}}", escapeXml(nativeId))
         .replaceAll("{{FOLDER}}", escapeXml(folder))
         .replace("{{SIGNATURE}}", definition.signature)
         .replace("{{TRIGGER_XML}}", triggerXml)
@@ -301,19 +496,23 @@ export function buildSchtasksXml(task, akmArgv, logDir, options) {
         .replace("{{ARGS}}", escapeXml(definition.args))
         .replace("{{LOG_PATH}}", escapeXml(definition.logPath));
 }
-function buildSchtasksDefinition(task, akmArgv, logDir, folder, contextPath, userSid, target) {
-    const spec = parseSchedule(task.schedule, "schtasks");
+function buildSchtasksDefinition(task, akmArgv, logDir, folder, contextPath, userSid, _target) {
+    const spec = parseSchedule(task.cron, "schtasks");
     const trigger = translateToSchtasks(spec);
-    const invocation = buildScheduledTaskInvocation(akmArgv, task.id, contextPath, target);
+    const invocation = buildScheduledBindingInvocation(akmArgv, contextPath, task.invocation);
     const invoke = `& ${invocation.argv.map((arg) => quotePowerShell(arg)).join(" ")}`;
-    const script = `${invoke}; exit $LASTEXITCODE`;
+    const executionEvidence = task.executionEvidenceDigest === undefined
+        ? ""
+        : `$null=${quotePowerShell(`akm-workflow-evidence:${assertSchedulerExecutionEvidenceDigest(task.executionEvidenceDigest)}`)}; `;
+    const script = `${executionEvidence}${invoke}; exit $LASTEXITCODE`;
     const command = "powershell.exe";
     const args = ["-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script].map(quoteArg).join(" ");
-    const logPath = path.join(logDir, `${task.id}.log`);
+    const nativeId = schedulerBindingNativeId(task);
+    const logPath = path.join(logDir, `${nativeId}.log`);
     // The boundary changes on reinstall, and enabled state can change via /Change.
     // Keep both outside the stored definition fingerprint so no-op sync stays stable.
     const fingerprint = createHash("sha256")
-        .update(JSON.stringify({ folder, id: task.id, trigger, command, args, logPath, userSid }))
+        .update(JSON.stringify({ folder, id: nativeId, trigger, command, args, logPath, userSid }))
         .digest("hex");
     return { trigger, command, args, logPath, signature: `${SIGNATURE_PREFIX}${fingerprint}` };
 }

package/dist/tasks/embedded.js

@@ -22,7 +22,7 @@
 import fs from "node:fs";
 import path from "node:path";
 import { getDirname } from "../runtime.js";
-import { parseTaskDocument } from "./parser.js";
+import { parseTaskV3Yaml } from "./source-v3.js";
 /** Directory holding the bundled task template categories. */
 const TASKS_ASSETS_DIR = path.join(getDirname(import.meta.url), "../assets/tasks");
 /**
@@ -67,20 +67,20 @@ export function listEmbeddedTasks() {
             }
             let task;
             try {
-                task = parseTaskDocument({ yaml, filePath, id });
+                task = parseTaskV3Yaml({ yaml, filePath, workspaceRoot: TASKS_ASSETS_DIR });
             }
             catch {
                 continue;
             }
-            if (task.target.kind !== "command")
+            if (task.target.kind !== "run" || task.akm?.schedule === undefined)
                 continue;
             tasks.push({
                 id,
                 label: `${category}/${id}`,
-                command: task.target.cmd.join(" "),
-                schedule: task.schedule,
-                description: task.description ?? "",
-                enabled: task.enabled,
+                command: task.target.run,
+                schedule: task.akm.schedule,
+                description: task.akm.description ?? "",
+                enabled: task.akm.enabled !== false,
                 yaml,
             });
         }

package/dist/tasks/frozen-script.js

@@ -0,0 +1,50 @@
+// This Source Code Form is subject to the terms of the Mozilla Public
+// License, v. 2.0. If a copy of the MPL was not distributed with this
+// file, You can obtain one at https://mozilla.org/MPL/2.0/.
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { assertNever } from "../core/assert.js";
+import { STANDALONE_FROZEN_SCRIPT_ARG } from "./standalone-script-entry.js";
+export function materializeFrozenScript(script) {
+    const bytes = Buffer.from(script.bytesBase64, "base64");
+    const digest = createHash("sha256").update(bytes).digest("hex");
+    if (bytes.byteLength !== script.byteLength || digest !== script.sha256) {
+        throw new Error(`Frozen script snapshot ${script.sourceRef} failed its byte/hash integrity check.`);
+    }
+    const directory = fs.mkdtempSync(path.join(os.tmpdir(), "akm-task-script-"));
+    const file = path.join(directory, `snapshot${script.extension}`);
+    fs.writeFileSync(file, bytes, { mode: 0o700 });
+    return Object.freeze({ directory, file });
+}
+export function frozenScriptCommand(script, materializedPath) {
+    switch (script.interpreter) {
+        case "bun":
+            return [process.execPath, materializedPath];
+        case "bun-standalone":
+            return [process.execPath, STANDALONE_FROZEN_SCRIPT_ARG, materializedPath];
+        case "powershell":
+            return ["powershell", "-NoProfile", "-NonInteractive", "-File", materializedPath];
+        case "cmd":
+            return ["cmd", "/d", "/s", "/c", materializedPath];
+        case "go":
+            return ["go", "run", materializedPath];
+        case "kotlin":
+            return script.extension === ".kts" ? ["kotlinc", "-script", materializedPath] : ["kotlin", materializedPath];
+        case "sh":
+        case "python":
+        case "ruby":
+        case "perl":
+        case "php":
+        case "lua":
+        case "rscript":
+        case "swift":
+            return [script.interpreter, materializedPath];
+        default:
+            return assertNever(script.interpreter, "frozenScriptCommand");
+    }
+}
+export function cleanupFrozenScript(materialized) {
+    fs.rmSync(materialized.directory, { recursive: true, force: true });
+}

package/dist/tasks/resolve-akm-bin.js

@@ -24,12 +24,16 @@ import path from "node:path";
 import { fileURLToPath } from "node:url";
 import { ConfigError } from "../core/errors.js";
 import { mainPath as runtimeMainPath } from "../runtime.js";
+/** True only for Bun's virtual main path inside a compiled standalone executable. */
+export function isBunStandaloneMain(mainPath = runtimeMainPath) {
+    return (mainPath?.startsWith("/$bunfs/") === true || (mainPath !== undefined && /^[A-Za-z]:[\\/]~BUN[\\/]/i.test(mainPath)));
+}
 export function resolveAkmInvocation(options = {}) {
     const env = options.env ?? process.env;
     const runtime = options.runtime ?? (process.versions.bun ? "bun" : "node");
     const execPath = options.execPath ?? process.execPath;
     const mainPath = options.mainPath ?? runtimeMainPath;
-    const isStandaloneMain = mainPath?.startsWith("/$bunfs/") || (mainPath !== undefined && /^[A-Za-z]:[\\/]~BUN[\\/]/i.test(mainPath));
+    const isStandaloneMain = isBunStandaloneMain(mainPath);
     if (runtime === "bun" && isStandaloneMain && execPath) {
         return { argv: [absoluteInvocationPath(execPath)], via: "standalone", kind: "standalone", eligible: true };
     }